diaspora / diaspora_federation

A library that provides functionalities needed for the diaspora* federation protocol.
GNU Affero General Public License v3.0
101 stars 29 forks source link

Tighten the validation of diaspora* IDs #86

Closed denschub closed 7 years ago

denschub commented 7 years ago

In a discussion with @SuperTux88, we discovered that our validation mechanism for diaspora* IDs is not perfect. In the documentation, there are two additional rules currently not covered by the validator:

The diaspora* ID is at most 255 chars long and it must be lowercase.

I altered the regex so that uppercased usernames and hostnames will fail the validation. This does not change our current behavior in reality, since diaspora* already fails when using uppercase characters.

While working on it, I replaced the letter, digit, and hexadecimal parts with their POSIX character class counterparts. Ultimately, this should make the final expression more readable. Because the parts are named now anyway, I removed the individual variable definitions for them.

In addition, I added a check that fails if the IDs length exceeds 255 characters.