Fix username validation in rws.

cmsranking/RankingWebServer.py

@@ -131,7 +131,7 @@ def authorized(self, request: Request):
 
     def get(self, request: Request, response: Response, key: str):
         # Limit charset of keys.
-        if re.match("^[A-Za-z0-9_]+$", key) is None:
+        if re.fullmatch("[A-Za-z0-9_]+", key) is None:
             return NotFound()
         if key not in self.store:
             raise NotFound()
@@ -149,7 +149,7 @@ def get_list(self, request: Request, response: Response):
 
     def put(self, request: Request, response: Response, key: str):
         # Limit charset of keys.
-        if re.match("^[A-Za-z0-9_]+$", key) is None:
+        if re.fullmatch("[A-Za-z0-9_]+", key) is None:
             return Forbidden()
         if not self.authorized(request):
             logger.warning("Unauthorized request.",
@@ -213,7 +213,7 @@ def put_list(self, request: Request, response: Response):
 
     def delete(self, request: Request, response: Response, key: str):
         # Limit charset of keys.
-        if re.match("^[A-Za-z0-9_]+$", key) is None:
+        if re.fullmatch("[A-Za-z0-9_]+", key) is None:
             return NotFound()
         if key not in self.store:
             raise NotFound()

cmsranking/Store.py

@@ -89,8 +89,7 @@ def load_from_disk(self):
 
         try:
             for name in os.listdir(self._path):
-                # TODO check that the key is '[A-Za-z0-9_]+'
-                if name[-5:] == '.json' and name[:-5] != '':
+                if name[-5:] == '.json' and re.fullmatch('[A-Za-z0-9_]+', name[:-5]):
                     with open(os.path.join(self._path, name), 'rb') as rec:
                         item = self._entity()
                         item.set(json.load(rec))
@@ -148,7 +147,9 @@ def create(self, key: str, data: dict):
             some properties or if properties are of the wrong type.
 
         """
-        if not isinstance(key, str) or key in self._store:
+        if not isinstance(key, str) or not re.fullmatch('[A-Za-z0-9_]+', key):
+            raise InvalidKey("Invalid key.")
+        if key in self._store:
             raise InvalidKey("Key already in store.")
 
         # create entity
@@ -232,7 +233,7 @@ def merge_list(self, data_dict: dict[str, dict]):
                 try:
                     # FIXME We should allow keys to be arbitrary unicode
                     # strings, so this just needs to be a non-empty check.
-                    if not re.match('[A-Za-z0-9_]+', key):
+                    if not isinstance(key, str) or not re.fullmatch('[A-Za-z0-9_]+', key):
                         raise InvalidData("Invalid key")
                     item = self._entity()
                     item.set(value)