Andreas/LibreChat
1
0
Fork 0
mirror of https://github.com/danny-avila/LibreChat.git synced 2025-09-22 06:00:56 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix: Allow Latin-based Special Characters in Username (#969)

Browse source 
* fix: username validation

* fix: add data-testid to fix e2e workflow
This commit is contained in:
Danny Avila 2023-09-18 16:57:12 -04:00 • committed by GitHub
parent b48c618f32
commit 1378eb5097
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 194 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

23
api/strategies/validators.js
View file

@ -11,6 +11,20 @@ function errorsToString(errors) {
.join(' ');
}
const allowedCharactersRegex = /^[a-zA-Z0-9_.@#$%&*()\p{Script=Latin}\p{Script=Common}]+$/u;
const injectionPatternsRegex = /('|--|\$ne|\$gt|\$lt|\$or|\{|\}|\*|;|<|>|\/|=)/i;
const usernameSchema = z
.string()
.min(2)
.max(80)
.refine((value) => allowedCharactersRegex.test(value), {
message: 'Invalid characters in username',
})
.refine((value) => !injectionPatternsRegex.test(value), {
message: 'Potential injection attack detected',
});
const loginSchema = z.object({
email: z.string().email(),
password: z
@ -26,14 +40,7 @@ const registerSchema = z
.object({
name: z.string().min(3).max(80),
username: z
.union([
z.literal(''),
z
.string()
.min(2)
.max(80)
.regex(/^[a-zA-Z0-9_.-@#$%&*() ]+$/),
])
.union([z.literal(''), usernameSchema])
.transform((value) => (value === '' ? null : value))
.optional()
.nullable(),