From 17658df8b67d7414b1a521db8931c060dda69a5a Mon Sep 17 00:00:00 2001
From: Benedikt Kulmann <benedikt@kulmann.biz>
Date: Wed, 12 Aug 2020 15:26:12 +0200
Subject: [PATCH] =?UTF-8?q?Allow=20+=20.=20and=20@=C2=A0in=20account=20ids?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkg/proto/v0/settings.pb.micro_test.go | 48 ++++++++++++++++++++++++++
 pkg/service/v0/validator.go            | 13 ++++---
 2 files changed, 57 insertions(+), 4 deletions(-)

diff --git a/pkg/proto/v0/settings.pb.micro_test.go b/pkg/proto/v0/settings.pb.micro_test.go
index 9df0e4b57..32cc289fe 100644
--- a/pkg/proto/v0/settings.pb.micro_test.go
+++ b/pkg/proto/v0/settings.pb.micro_test.go
@@ -1173,6 +1173,54 @@ func TestSaveGetListSettingsValues(t *testing.T) {
 				Status: "Internal Server Error",
 			},
 		},
+		{
+			testDataName: "../ in account uuid",
+			SettingsValue: proto.SettingsValue{
+				Identifier: &proto.Identifier{
+					Extension:   "great-extension",
+					BundleKey:   "bobs-bundle",
+					AccountUuid: "../123e4567-e89b-12d3-a456-426652340000",
+					SettingKey:  "should-not-be-possible",
+				},
+				Value: &proto.SettingsValue_BoolValue{BoolValue: false},
+			},
+			expectedError: CustomError{
+				ID:     "go.micro.client",
+				Code:   500,
+				Detail: "account_uuid: must be in a valid format.",
+				Status: "Internal Server Error",
+			},
+		},
+		{
+			testDataName: "\\ in fields that are used to create folder and file names",
+			SettingsValue: proto.SettingsValue{
+				Identifier: &proto.Identifier{
+					Extension:   "\\-extension",
+					BundleKey:   "\\-bundle",
+					AccountUuid: "\\123e4567-e89b-12d3-a456-426652340000",
+					SettingKey:  "should-not-be-possible",
+				},
+				Value: &proto.SettingsValue_BoolValue{BoolValue: false},
+			},
+			expectedError: CustomError{
+				ID:     "go.micro.client",
+				Code:   500,
+				Detail: "account_uuid: must be in a valid format; bundle_key: must be in a valid format; extension: must be in a valid format.",
+				Status: "Internal Server Error",
+			},
+		},
+		{
+			testDataName: "account uuid allows alphanumeric and +_.-@",
+			SettingsValue: proto.SettingsValue{
+				Identifier: &proto.Identifier{
+					Extension:   "extension",
+					BundleKey:   "bundle",
+					AccountUuid: "123-abc-ABC-+_.-@",
+					SettingKey:  "setting",
+				},
+				Value: &proto.SettingsValue_BoolValue{BoolValue: false},
+			},
+		},
 	}
 	client := service.Client()
 	cl := proto.NewValueService("com.owncloud.api.settings", client)
diff --git a/pkg/service/v0/validator.go b/pkg/service/v0/validator.go
index defa45ff7..4995399fe 100644
--- a/pkg/service/v0/validator.go
+++ b/pkg/service/v0/validator.go
@@ -8,8 +8,13 @@ import (
 )
 
 var (
-	regexForKeys = regexp.MustCompile(`^[A-Za-z0-9\-_]*$`)
-	keyRule      = []validation.Rule{
+	regexForAccountUUID = regexp.MustCompile(`^[A-Za-z0-9\-_.+@]+$`)
+	accountUUIDRule     = []validation.Rule{
+		validation.Required,
+		validation.Match(regexForAccountUUID),
+	}
+	regexForKeys        = regexp.MustCompile(`^[A-Za-z0-9\-_]*$`)
+	keyRule             = []validation.Rule{
 		validation.Required,
 		validation.Match(regexForKeys),
 	}
@@ -48,7 +53,7 @@ func validateGetSettingsValue(req *proto.GetSettingsValueRequest) error {
 func validateListSettingsValues(req *proto.ListSettingsValuesRequest) error {
 	return validation.ValidateStruct(
 		req.Identifier,
-		validation.Field(&req.Identifier.AccountUuid, keyRule...),
+		validation.Field(&req.Identifier.AccountUuid, accountUUIDRule...),
 		validation.Field(&req.Identifier.Extension, validation.Match(regexForKeys)),
 		validation.Field(&req.Identifier.Extension, validation.When(req.Identifier.BundleKey != "", validation.Required)),
 		validation.Field(&req.Identifier.BundleKey, validation.Match(regexForKeys)),
@@ -71,6 +76,6 @@ func validateValueIdentifier(identifier *proto.Identifier) error {
 		validation.Field(&identifier.Extension, keyRule...),
 		validation.Field(&identifier.BundleKey, keyRule...),
 		validation.Field(&identifier.SettingKey, keyRule...),
-		validation.Field(&identifier.AccountUuid, keyRule...),
+		validation.Field(&identifier.AccountUuid, accountUUIDRule...),
 	)
 }