From a4b1ad6d2275c0a5e90ac7eb3ed6a5c3331a7d95 Mon Sep 17 00:00:00 2001
From: kske <kai@kske.dev>
Date: Fri, 26 Jun 2020 22:04:40 +0200
Subject: [PATCH] Validate user name during registration

---
 .../processors/LoginCredentialProcessor.java  | 43 +++++++++++--------
 1 file changed, 25 insertions(+), 18 deletions(-)

diff --git a/src/main/java/envoy/server/processors/LoginCredentialProcessor.java b/src/main/java/envoy/server/processors/LoginCredentialProcessor.java
index ad7addd..0a248c9 100755
--- a/src/main/java/envoy/server/processors/LoginCredentialProcessor.java
+++ b/src/main/java/envoy/server/processors/LoginCredentialProcessor.java
@@ -20,6 +20,7 @@ import envoy.server.data.PersistenceManager;
 import envoy.server.data.User;
 import envoy.server.net.ConnectionManager;
 import envoy.server.net.ObjectWriteProxy;
+import envoy.util.Bounds;
 import envoy.util.EnvoyLog;
 
 /**
@@ -38,7 +39,7 @@ public final class LoginCredentialProcessor implements ObjectProcessor<LoginCred
 	private final PersistenceManager	persistenceManager	= PersistenceManager.getInstance();
 	private final ConnectionManager		connectionManager	= ConnectionManager.getInstance();
 
-	private static final Logger		logger			= EnvoyLog.getLogger(LoginCredentialProcessor.class);
+	private static final Logger logger = EnvoyLog.getLogger(LoginCredentialProcessor.class);
 
 	@Override
 	public void process(LoginCredentials credentials, long socketID, ObjectWriteProxy writeProxy) throws IOException {
@@ -76,25 +77,31 @@ public final class LoginCredentialProcessor implements ObjectProcessor<LoginCred
 				return;
 			}
 		} else {
-			try {
-				// Checking that no user already has this identifier
-				PersistenceManager.getInstance().getUserByName(credentials.getIdentifier());
-
-				// This code only gets executed if this user already exists
-				logger.info("The requested user already exists.");
-				writeProxy.write(socketID, new HandshakeRejection(USERNAME_TAKEN));
+			// Validate user name
+			if (!Bounds.isValidContactName(credentials.getIdentifier())) {
+				logger.info("The requested user name is not valid.");
+				writeProxy.write(socketID, new HandshakeRejection(INTERNAL_ERROR));
 				return;
-			} catch (NoResultException e) {
-				// Creation of a new user
-				user = new User();
-				user.setName(credentials.getIdentifier());
-				user.setLastSeen(LocalDateTime.now());
-				user.setStatus(ONLINE);
-				user.setPasswordHash(credentials.getPasswordHash());
-				user.setContacts(new HashSet<>());
-				persistenceManager.addContact(user);
-				logger.info("Registered new " + user);
 			}
+				try {
+					// Checking that no user already has this identifier
+					PersistenceManager.getInstance().getUserByName(credentials.getIdentifier());
+
+					// This code only gets executed if this user already exists
+					logger.info("The requested user already exists.");
+					writeProxy.write(socketID, new HandshakeRejection(USERNAME_TAKEN));
+					return;
+				} catch (NoResultException e) {
+					// Creation of a new user
+					user = new User();
+					user.setName(credentials.getIdentifier());
+					user.setLastSeen(LocalDateTime.now());
+					user.setStatus(ONLINE);
+					user.setPasswordHash(credentials.getPasswordHash());
+					user.setContacts(new HashSet<>());
+					persistenceManager.addContact(user);
+					logger.info("Registered new " + user);
+				}
 		}
 
 		logger.info(user + " successfully authenticated.");