Tighten URL slug validation (#6442)

* Tighten URL slug validation

* slug sanitization in frontend

apps/labrinth/src/routes/v2/users.rs

@@ -184,14 +184,14 @@ pub async fn projects_list(
 
 #[derive(Serialize, Deserialize, Validate, utoipa::ToSchema)]
 pub struct EditUser {
-    #[validate(length(min = 1, max = 39), regex(path = *crate::util::validate::RE_USERNAME))]
+    #[validate(length(min = 1, max = 39), regex(path = *crate::util::validate::RE_URL_SAFE))]
     pub username: Option<String>,
     #[serde(
         default,
         skip_serializing_if = "Option::is_none",
         with = "::serde_with::rust::double_option"
     )]
-    #[validate(length(min = 1, max = 64), regex(path = *crate::util::validate::RE_USERNAME))]
+    #[validate(length(min = 1, max = 64), regex(path = *crate::util::validate::RE_URL_SAFE))]
     pub name: Option<Option<String>>,
     #[serde(
         default,

apps/labrinth/src/routes/v2/version_creation.rs

@@ -36,7 +36,7 @@ pub struct InitialVersionData {
     pub file_parts: Vec<String>,
     #[validate(
         length(min = 1, max = 32),
-        regex(path = *crate::util::validate::RE_URL_SAFE)
+        regex(path = *crate::util::validate::RE_URL_SAFE_RELAXED)
     )]
     pub version_number: String,
     #[validate(

apps/labrinth/src/routes/v2/versions.rs

@@ -314,7 +314,7 @@ pub struct EditVersion {
     pub name: Option<String>,
     #[validate(
         length(min = 1, max = 32),
-        regex(path = *crate::util::validate::RE_URL_SAFE)
+        regex(path = *crate::util::validate::RE_URL_SAFE_RELAXED)
     )]
     pub version_number: Option<String>,
     #[validate(length(max = 65536))]

apps/labrinth/src/routes/v3/project_creation/new.rs

@@ -101,6 +101,7 @@ impl ResponseError for CreateError {
 
 #[derive(Debug, Clone, Serialize, Deserialize, Validate, utoipa::ToSchema)]
 pub struct ProjectCreate {
+    #[validate(nested)]
     pub base: exp::base::Project,
     #[serde(flatten)]
     #[validate(nested)]
@@ -338,3 +339,59 @@ pub async fn create(
 
     Ok(web::Json(project_id))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::models::projects::ProjectStatus;
+
+    fn project_create_with_slug(slug: &str) -> ProjectCreate {
+        ProjectCreate {
+            base: exp::base::Project {
+                name: "test project".into(),
+                slug: slug.into(),
+                summary: "test summary".into(),
+                description: String::new(),
+                requested_status: ProjectStatus::Approved,
+                organization_id: None,
+            },
+            components: exp::ProjectEdit {
+                minecraft_mod: None,
+                minecraft_server: None,
+                minecraft_java_server: None,
+                minecraft_bedrock_server: None,
+            },
+        }
+    }
+
+    fn assert_project_slug_validation(slug: &str, expected_valid: bool) {
+        let result = project_create_with_slug(slug).validate();
+
+        assert_eq!(
+            result.is_ok(),
+            expected_valid,
+            "unexpected validation result for slug `{slug}`"
+        );
+    }
+
+    #[test]
+    fn project_create_accepts_url_safe_base_slugs() {
+        for slug in ["valid-slug", "valid_slug", "valid.slug", "valid123"] {
+            assert_project_slug_validation(slug, true);
+        }
+    }
+
+    #[test]
+    fn project_create_rejects_unsafe_base_slugs() {
+        for slug in [
+            "invalid/slug",
+            "../invalid",
+            r#"invalid"slug"#,
+            "invalid$slug",
+            "invalid slug",
+            "invalid#slug",
+        ] {
+            assert_project_slug_validation(slug, false);
+        }
+    }
+}

apps/labrinth/src/routes/v3/users.rs

@@ -642,7 +642,7 @@ pub async fn orgs_list(
 
 #[derive(Serialize, Deserialize, Validate)]
 pub struct EditUser {
-    #[validate(length(min = 1, max = 39), regex(path = *crate::util::validate::RE_USERNAME))]
+    #[validate(length(min = 1, max = 39), regex(path = *crate::util::validate::RE_URL_SAFE))]
     pub username: Option<String>,
     #[serde(
         default,

apps/labrinth/src/routes/v3/version_creation.rs

@@ -56,7 +56,7 @@ pub struct InitialVersionData {
     pub file_parts: Vec<String>,
     #[validate(
         length(min = 1, max = 32),
-        regex(path = *crate::util::validate::RE_URL_SAFE)
+        regex(path = *crate::util::validate::RE_URL_SAFE_RELAXED)
     )]
     pub version_number: String,
     #[validate(

apps/labrinth/src/routes/v3/versions.rs

@@ -222,7 +222,7 @@ pub struct EditVersion {
     pub name: Option<String>,
     #[validate(
         length(min = 1, max = 32),
-        regex(path = *crate::util::validate::RE_URL_SAFE)
+        regex(path = *crate::util::validate::RE_URL_SAFE_RELAXED)
     )]
     pub version_number: Option<String>,
     #[validate(length(max = 65536))]