Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sanitize/validate service name input #6423

Open
n1ru4l opened this issue Jan 27, 2025 · 0 comments
Open

sanitize/validate service name input #6423

n1ru4l opened this issue Jan 27, 2025 · 0 comments

Comments

@n1ru4l
Copy link
Contributor

n1ru4l commented Jan 27, 2025

We should validate and sanitize the service name for schema publishes and schema checks. Right now the service string can be anything, including whitespace and special characters.

We should limit it more to have:

  • maximum length
  • disallow spaces
  • disallow certain special characters

We need to consider already existing services published to our database and ensure that introducing the limits does not break any existing users.

Characters used within our pg database today:

 "-./0123456789_abcdefghijklmnopqrstuvwxyz{}“”
how we extracted the list

select string_agg(c,'')
from (
  select distinct regexp_split_to_table(lower(service_name),'') as c
  from schema_log
) t

Some of those look like unintended user mistakes when publishing the schema:

  • { and } seem like wrongly interpolated environment variables on CI systems (projects using this are not active; or all services deleted)
  • and also seem like wrongly interpolated environment variables on CI systems (project using this are not active; or all services deleted)

Proposed allowed characters:

  • alphanumeric
  • dots
  • underscore
  • slash
  • dash
@n1ru4l n1ru4l changed the title sanitzie/validate service name input sanitize/validate service name input Jan 27, 2025
@linear linear bot added the improvement label Jan 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

No branches or pull requests

1 participant