mirror of
https://github.com/documenso/documenso.git
synced 2026-08-23 23:02:22 +10:00
Merge branch 'main' into feat/acroform-field-import
This commit is contained in:
Ephraim Duncan
@@ -0,0 +1,145 @@
|
||||
import { describe, expect, it } from 'vitest';
|
||||
|
||||
import { ZNameSchema } from './name';
|
||||
|
||||
describe('ZNameSchema', () => {
|
||||
describe('valid names', () => {
|
||||
it('accepts a normal name', () => {
|
||||
expect(ZNameSchema.safeParse('Example User')).toEqual({
|
||||
success: true,
|
||||
data: 'Example User',
|
||||
});
|
||||
});
|
||||
|
||||
it('accepts international characters', () => {
|
||||
expect(ZNameSchema.safeParse('Døcumensø Üser')).toEqual({
|
||||
success: true,
|
||||
data: 'Døcumensø Üser',
|
||||
});
|
||||
});
|
||||
|
||||
it('trims surrounding whitespace', () => {
|
||||
expect(ZNameSchema.safeParse(' Documenso User ')).toEqual({
|
||||
success: true,
|
||||
data: 'Documenso User',
|
||||
});
|
||||
});
|
||||
|
||||
it('accepts names at the minimum length', () => {
|
||||
expect(ZNameSchema.safeParse('DU')).toEqual({
|
||||
success: true,
|
||||
data: 'DU',
|
||||
});
|
||||
});
|
||||
|
||||
it('accepts names at the maximum length', () => {
|
||||
const name =
|
||||
'DocumensoUser DocumensoUser DocumensoUser DocumensoUser DocumensoUser DocumensoUser DocumensoUser Do';
|
||||
|
||||
expect(name.length).toBe(100);
|
||||
expect(ZNameSchema.safeParse(name)).toEqual({
|
||||
success: true,
|
||||
data: name,
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
describe('length validation', () => {
|
||||
it('rejects names shorter than 2 characters', () => {
|
||||
expect(ZNameSchema.safeParse('D')).toMatchObject({
|
||||
success: false,
|
||||
error: {
|
||||
issues: [{ message: 'Please enter a valid name.' }],
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it('rejects names longer than 100 characters', () => {
|
||||
const name =
|
||||
'DocumensoUser DocumensoUser DocumensoUser DocumensoUser DocumensoUser DocumensoUser DocumensoUser Doc';
|
||||
|
||||
expect(name.length).toBe(101);
|
||||
expect(ZNameSchema.safeParse(name)).toMatchObject({
|
||||
success: false,
|
||||
error: {
|
||||
issues: [{ message: 'Name cannot be more than 100 characters.' }],
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it('rejects whitespace-only input after trim', () => {
|
||||
expect(ZNameSchema.safeParse(' ')).toMatchObject({
|
||||
success: false,
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
describe('URL validation', () => {
|
||||
it.each([
|
||||
'https://example.com',
|
||||
'http://example.com',
|
||||
'HTTPS://EXAMPLE.COM',
|
||||
'Northwind www.example.com',
|
||||
'www.example.com',
|
||||
])('rejects URLs in names: %s', (value) => {
|
||||
expect(ZNameSchema.safeParse(value)).toMatchObject({
|
||||
success: false,
|
||||
error: {
|
||||
issues: expect.arrayContaining([expect.objectContaining({ message: 'Name cannot contain URLs.' })]),
|
||||
},
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
describe('invalid character validation', () => {
|
||||
it.each([
|
||||
['NUL character', 'Acme\u0000Corp'],
|
||||
['zero-width space', 'Acme\u200bCorp'],
|
||||
['bidi override', 'Acme\u202eCorp'],
|
||||
['byte order mark', 'Acme\ufeffCorp'],
|
||||
['lone surrogate', 'Acme\ud800Corp'],
|
||||
['tag character', `Acme${String.fromCodePoint(0xe0041)}Corp`],
|
||||
['noncharacter', 'Acme\ufffeCorp'],
|
||||
['private use character', 'Acme\ue000Corp'],
|
||||
['Hangul filler', 'Acme\u3164Corp'],
|
||||
['braille blank', 'Acme\u2800Corp'],
|
||||
['combining grapheme joiner', 'Acme\u034fCorp'],
|
||||
])('rejects names containing a %s', (_label, value) => {
|
||||
expect(ZNameSchema.safeParse(value)).toMatchObject({
|
||||
success: false,
|
||||
error: {
|
||||
issues: expect.arrayContaining([expect.objectContaining({ message: 'Name contains invalid characters.' })]),
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it.each([
|
||||
['fixed form', String.raw`Acme\u200bCorp`],
|
||||
['uppercase U', String.raw`Acme\U200BCorp`],
|
||||
['braced form', String.raw`Acme\u{200b}Corp`],
|
||||
['braced form with leading zeros', String.raw`Acme\u{0000200b}Corp`],
|
||||
['lone surrogate', String.raw`Acme\ud800Corp`],
|
||||
])('rejects literal \\u escape sequences stored as text (%s)', (_label, value) => {
|
||||
expect(ZNameSchema.safeParse(value)).toMatchObject({
|
||||
success: false,
|
||||
error: {
|
||||
issues: expect.arrayContaining([expect.objectContaining({ message: 'Name contains invalid characters.' })]),
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it.each([
|
||||
['escape of a valid code point', String.raw`Acme\u0041Corp`],
|
||||
['braced escape of a valid astral code point', String.raw`Acme\u{1F600}Corp`],
|
||||
['braced escape beyond the Unicode range', String.raw`Acme\u{FFFFFFF}Corp`],
|
||||
['incomplete escape sequence', String.raw`Acme\u00 Corp`],
|
||||
['unterminated braced escape', String.raw`Acme\u{200bCorp`],
|
||||
['astral characters such as emoji', 'Acme 😀 Corp'],
|
||||
['emoji with a variation selector', 'I ❤️ Docs'],
|
||||
])('accepts %s', (_label, value) => {
|
||||
expect(ZNameSchema.safeParse(value)).toMatchObject({
|
||||
success: true,
|
||||
});
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,68 @@
|
||||
import { z } from 'zod';
|
||||
|
||||
export const URL_PATTERN = /https?:\/\/|www\./i;
|
||||
|
||||
/**
|
||||
* Characters that render as empty/invisible or break text layout:
|
||||
*
|
||||
* - `\p{C}` - control, format, lone surrogate, private use and
|
||||
* unassigned code points (NUL, zero-width spaces, bidi
|
||||
* overrides, BOM, tag characters, noncharacters).
|
||||
* - `\p{Zl}\p{Zp}` - line and paragraph separators.
|
||||
* - `\u{034F}` - combining grapheme joiner (invisible). Kept outside the
|
||||
* character class because it is a combining mark, which
|
||||
* lint rules reject inside classes.
|
||||
* - remaining - letters that render as blank (Hangul fillers, braille blank).
|
||||
*
|
||||
* The `\p{...}` classes are maintained by the Unicode database, so newly
|
||||
* assigned characters in these categories are covered automatically.
|
||||
*/
|
||||
const INVALID_CHARACTER_REGEX = /[\p{C}\p{Zl}\p{Zp}\u{115F}\u{1160}\u{2800}\u{3164}\u{FFA0}]|\u{034F}/u;
|
||||
|
||||
const hasInvalidCharacter = (value: string) => INVALID_CHARACTER_REGEX.test(value);
|
||||
|
||||
/**
|
||||
* Matches literal `\uXXXX` and `\u{XXXX}` escape sequences stored verbatim as
|
||||
* text (e.g. the 6 characters `\`, `u`, `2`, `0`, `0`, `b`), which can still
|
||||
* break rendering downstream if anything decodes them.
|
||||
*/
|
||||
const ESCAPE_SEQUENCE_PATTERN = /\\u(?:([0-9a-f]{4})|\{([0-9a-f]+)\})/gi;
|
||||
|
||||
const hasInvalidEscapeSequence = (value: string) => {
|
||||
for (const [, fixedHex, bracedHex] of value.matchAll(ESCAPE_SEQUENCE_PATTERN)) {
|
||||
const codePoint = parseInt(fixedHex ?? bracedHex, 16);
|
||||
|
||||
if (codePoint > 0x10ffff) {
|
||||
continue;
|
||||
}
|
||||
|
||||
// Decode the escape and run it through the same character policy as the
|
||||
// unescaped check, so the two can never drift apart.
|
||||
if (hasInvalidCharacter(String.fromCodePoint(codePoint))) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
};
|
||||
|
||||
export const hasInvalidTextCharacters = (value: string) =>
|
||||
hasInvalidCharacter(value) || hasInvalidEscapeSequence(value);
|
||||
|
||||
/**
|
||||
* Shared name schema that disallows URLs to prevent phishing via email rendering,
|
||||
* and invisible/control characters that render as empty or break the UI.
|
||||
*/
|
||||
export const ZNameSchema = z
|
||||
.string()
|
||||
.trim()
|
||||
.min(2, { message: 'Please enter a valid name.' })
|
||||
.max(100, { message: 'Name cannot be more than 100 characters.' })
|
||||
.refine((value) => !URL_PATTERN.test(value), {
|
||||
message: 'Name cannot contain URLs.',
|
||||
})
|
||||
.refine((value) => !hasInvalidTextCharacters(value), {
|
||||
message: 'Name contains invalid characters.',
|
||||
});
|
||||
|
||||
export type TName = z.infer<typeof ZNameSchema>;
|
||||
@@ -6,14 +6,39 @@ import { z } from 'zod';
|
||||
*
|
||||
* Example: "5m", "1h", "1d"
|
||||
*/
|
||||
export const ZRateLimitWindowSchema = z.string().regex(/^\d+[smhd]$/);
|
||||
export const RATE_LIMIT_WINDOW_REGEX = /^\d+[smhd]$/;
|
||||
|
||||
export const ZRateLimitArraySchema = z.array(
|
||||
z.object({
|
||||
window: ZRateLimitWindowSchema,
|
||||
max: z.number().int().positive(),
|
||||
}),
|
||||
);
|
||||
const RATE_LIMIT_WINDOW_ERROR_MESSAGE = 'Use a duration with a unit, e.g. 5m, 1h, or 24h';
|
||||
const RATE_LIMIT_DUPLICATE_WINDOW_ERROR_MESSAGE = 'Use a unique window for each rate limit';
|
||||
|
||||
export const ZRateLimitWindowSchema = z.string().trim().regex(RATE_LIMIT_WINDOW_REGEX, {
|
||||
message: RATE_LIMIT_WINDOW_ERROR_MESSAGE,
|
||||
});
|
||||
|
||||
export const ZRateLimitArraySchema = z
|
||||
.array(
|
||||
z.object({
|
||||
window: ZRateLimitWindowSchema,
|
||||
max: z.number().int().positive(),
|
||||
}),
|
||||
)
|
||||
.superRefine((entries, ctx) => {
|
||||
const windows = new Set<string>();
|
||||
|
||||
entries.forEach((entry, index) => {
|
||||
const window = entry.window.trim();
|
||||
|
||||
if (windows.has(window)) {
|
||||
ctx.addIssue({
|
||||
code: z.ZodIssueCode.custom,
|
||||
message: RATE_LIMIT_DUPLICATE_WINDOW_ERROR_MESSAGE,
|
||||
path: [index, 'window'],
|
||||
});
|
||||
}
|
||||
|
||||
windows.add(window);
|
||||
});
|
||||
});
|
||||
|
||||
export type TRateLimitArray = z.infer<typeof ZRateLimitArraySchema>;
|
||||
|
||||
|
||||
Reference in New Issue
Block a user