Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sanitize/validate service name input #6423

Closed
n1ru4l opened this issue Jan 27, 2025 · 1 comment · Fixed by #6585
Closed

sanitize/validate service name input #6423

n1ru4l opened this issue Jan 27, 2025 · 1 comment · Fixed by #6585

Comments

@n1ru4l
Copy link
Contributor

n1ru4l commented Jan 27, 2025

We should validate and sanitize the service name for schema publishes and schema checks. Right now the service string can be anything, including whitespace and special characters.

We should limit it more to have:

  • maximum length
  • disallow spaces
  • disallow certain special characters

We need to consider already existing services published to our database and ensure that introducing the limits does not break any existing users.

Characters used within our pg database today:

 "-./0123456789_abcdefghijklmnopqrstuvwxyz{}“”
how we extracted the list

select string_agg(c,'')
from (
  select distinct regexp_split_to_table(lower(service_name),'') as c
  from schema_log
) t

Some of those look like unintended user mistakes when publishing the schema:

  • { and } seem like wrongly interpolated environment variables on CI systems (projects using this are not active; or all services deleted)
  • and also seem like wrongly interpolated environment variables on CI systems (project using this are not active; or all services deleted)

Proposed allowed characters:

  • alphanumeric
  • dots
  • underscore
  • slash
  • dash
@n1ru4l n1ru4l changed the title sanitzie/validate service name input sanitize/validate service name input Jan 27, 2025
@linear linear bot added the improvement label Jan 30, 2025
@kamilkisiela kamilkisiela added the registry label Jan 31, 2025 — with Linear
@jdolle jdolle self-assigned this Mar 5, 2025
@jdolle
Copy link
Collaborator

jdolle commented Mar 5, 2025

For now I think we should only validate when creating a new service. We can then work to migrate existing services if we need to. But I don't want to break anyone's services if for some reason they are using one of these characters.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging a pull request may close this issue.

3 participants