#109 Cleanup FAS usernames before doing anything else with them
Merged 3 years ago by frantisekz. Opened 3 years ago by frantisekz.

@@ -55,6 +55,10 @@ 

  def route_dashboard_user_data(user):

      if user == 'orphan':

          return jsonify(CACHE.get('packager-dashboard_orphan_page'))

+ 

+     # Cleanup the username to follow FAS naming restrictions

+     user = dashboard_helpers.clean_fas_username(user)

+ 

      packages_promise = CACHE.async_get('packager-dashboard_user_data_static', 'high', user)

      last_synced = CACHE.get_refreshed_time('packager-dashboard_user_data_static', user)

      if packages_promise == cache_utils.RefresherNotRegistered:

@@ -135,6 +135,12 @@ 

          row.last_accessed = datetime.datetime.utcnow()

      db.session.commit()

  

+ def clean_fas_username(user):

+     """

+     Cleans up username to contain only characters allowed in FAS usernames

+     Alphanum and ["_", "-", ".", "$"] characters are allowed

+     """

+     return re.sub(r'[^a-zA-Z0-9_.$-]', '', user)

  

  def name_in_nevra(name, nevra):

      """

@@ -127,3 +127,7 @@ 

  

          monkeypatch.setattr(dashboard_helpers, 'get_resource', mock.MagicMock(return_value=invalid_yaml))

          assert not dashboard_helpers.get_yaml("mocked_url")

+ 

+     def test_clean_fas_username(self, monkeypatch):

+ 

+         assert dashboard_helpers.clean_fas_username("朋友1234...∞u<>?🐶??🐶:Os🐶$._🐶-_(🐶)'\'/eríížžř朋友") == "1234...uOs$._-_er"

no initial comment

Build succeeded.

LGTM. I was thinking whether just returning "no data" for the "non logins" would be better, but since we are dealing with "public" data anyway, I think going for "best effort to give the user something" is the right approach.

Thanks!

Pull-Request has been merged by frantisekz

3 years ago