diff options
| author | Ophestra Umiker <cat@ophivana.moe> | 2024-11-19 21:01:41 +0900 |
|---|---|---|
| committer | Ophestra Umiker <cat@ophivana.moe> | 2024-11-19 21:01:41 +0900 |
| commit | 9faf3b3596c973cb75da7a843e2df1292df0a537 (patch) | |
| tree | 8c3cbcd9e03eb9671b51e2e61af09fcf370234f6 /internal/app | |
| parent | d99c8b1fb4a4d967c1f8d78af4454ce04d725594 (diff) | |
app: validate username
This value is used for passwd generation. Bad input can cause very confusing issues. This is not a security issue, however validation will improve user experience.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
Diffstat (limited to 'internal/app')
| -rw-r--r-- | internal/app/seal.go | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/internal/app/seal.go b/internal/app/seal.go index 5ad588d0..d3c7a875 100644 --- a/internal/app/seal.go +++ b/internal/app/seal.go @@ -5,6 +5,7 @@ import ( "fmt" "io/fs" "path" + "regexp" "strconv" shim "git.ophivana.moe/security/fortify/cmd/fshim/ipc" @@ -19,8 +20,11 @@ var ( ErrConfig = errors.New("no configuration to seal") ErrUser = errors.New("invalid aid") ErrHome = errors.New("invalid home directory") + ErrName = errors.New("invalid username") ) +var posixUsername = regexp.MustCompilePOSIX("^[a-z_]([A-Za-z0-9_-]{0,31}|[A-Za-z0-9_-]{0,30}\\$)$") + // appSeal seals the application with child-related information type appSeal struct { // app unique ID string representation @@ -106,6 +110,9 @@ func (a *app) Seal(config *Config) error { } if seal.sys.user.username == "" { seal.sys.user.username = "chronos" + } else if !posixUsername.MatchString(seal.sys.user.username) { + return fmsg.WrapError(ErrName, + fmt.Sprintf("invalid user name %q", seal.sys.user.username)) } if seal.sys.user.data == "" || !path.IsAbs(seal.sys.user.data) { return fmsg.WrapError(ErrHome, |