HMS-2714 fix description and title validation

internal/infrastructure/middleware/validate_api.go

@@ -7,6 +7,8 @@ import (
 	"fmt"
 	"net/http"
 	"regexp"
+	"unicode"
+	"unicode/utf8"
 
 	"github.com/getkin/kin-openapi/openapi3"
 	"github.com/getkin/kin-openapi/openapi3filter"
@@ -46,8 +48,8 @@ func InitOpenAPIFormats() {
 	openapi3.DefineStringFormatCallback("cert-subject", func(value string) error {
 		return checkFormatSubject(value)
 	})
-	openapi3.DefineStringFormat("domain-description", `^[\n\x20-\x7E]*$`)
-	openapi3.DefineStringFormat("domain-title", `^[a-zA-Z0-9\s]+$`)
+	openapi3.DefineStringFormatCallback("domain-description", checkUtf8MultiLine)
+	openapi3.DefineStringFormatCallback("domain-title", checkUtf8SingleLine)
 	openapi3.DefineStringFormatCallback("ipa-realm-domains", func(value string) error {
 		return checkFormatRealmDomains(value)
 	})
@@ -67,6 +69,34 @@ func helperCheckRegEx(regex string, fieldName string, fieldValue string) error {
 	return nil
 }
 
+// Check that input is a valid UTF-8 string with no control characters
+// (not even CR/LF).
+func checkUtf8SingleLine(s string) error {
+	if !utf8.ValidString(s) {
+		return fmt.Errorf("not a valid utf-8 string")
+	}
+	for _ /* index */, r /* rune */ := range s {
+		if unicode.IsControl(r) {
+			return fmt.Errorf("invalid code point: %U", r)
+		}
+	}
+	return nil
+}
+
+// Check that input is a valid UTF-8 string with no control characters,
+// except spacing chars including CR/LF are allowed.
+func checkUtf8MultiLine(s string) error {
+	if !utf8.ValidString(s) {
+		return fmt.Errorf("not a valid utf-8 string")
+	}
+	for _ /* index */, r /* rune */ := range s {
+		if unicode.IsControl(r) && !unicode.IsSpace(r) {
+			return fmt.Errorf("invalid code point: %U", r)
+		}
+	}
+	return nil
+}
+
 // checkCertificateFormat check the pem certificate string represented
 // by value that can be parsed.
 // Return an error or nil for success parsed data.
@@ -232,6 +262,7 @@ func RequestResponseValidatorWithConfig(config *RequestResponseValidatorConfig)
 				if err != nil {
 					c.Response().Header().Set(echo.HeaderContentType, "text/plain")
 					c.String(http.StatusBadRequest, err.Error())
+					return nil // stop processing
 				}
 			}
 

internal/infrastructure/middleware/validate_api_test.go

@@ -91,6 +91,32 @@ MII..
 	assert.EqualError(t, err, "Failed to decode CA certificate")
 }
 
+func TestCheckUtf8SingleLine(t *testing.T) {
+	var err error
+
+	err = checkUtf8SingleLine("This is an invalid utf-8 string\xF1")
+	assert.EqualError(t, err, "not a valid utf-8 string")
+
+	err = checkUtf8SingleLine("This is an invalid title\n")
+	assert.EqualError(t, err, "invalid code point: U+000A")
+
+	err = checkUtf8SingleLine("This a valid title")
+	assert.NoError(t, err)
+}
+
+func TestCheckUtf8MultiLine(t *testing.T) {
+	var err error
+
+	err = checkUtf8MultiLine("\n\r\t\v\fThis is an invalid utf-8 string\xF1")
+	assert.EqualError(t, err, "not a valid utf-8 string")
+
+	err = checkUtf8MultiLine("\n\r\t\v\fThis is an invalid title\x02")
+	assert.EqualError(t, err, "invalid code point: U+0002")
+
+	err = checkUtf8MultiLine("\n\r\t\v\fThis a valid title")
+	assert.NoError(t, err)
+}
+
 func TestInitOpenAPIFormats(t *testing.T) {
 	InitOpenAPIFormats()
 }