users: disallow more names ending with file extensions.

Disallow any name that has a suffix registered as a file extension in Rails.
This commit is contained in:
evazion
2022-12-05 20:39:27 -06:00
parent d9dc84325f
commit d157899226
2 changed files with 2 additions and 1 deletions

View File

@@ -32,7 +32,7 @@ class UserNameValidator < ActiveModel::EachValidator
rec.errors.add(attr, "can't start with '#{name.first}'")
elsif name =~ /[[:punct:]]\z/
rec.errors.add(attr, "can't end with '#{name.last}'")
elsif name =~ /\.(html|json|xml|atom|rss|txt|js|css|csv|png|jpg|jpeg|gif|png|avif|webp|mp4|webm|zip|pdf|exe|sitemap)\z/i
elsif name =~ /\.(#{Mime::EXTENSION_LOOKUP.keys.join("|")})\z/i
rec.errors.add(attr, "can't end with a file extension")
elsif name =~ /__/
rec.errors.add(attr, "can't contain multiple underscores in a row")

View File

@@ -9,3 +9,4 @@ Mime::Type.register "image/webp", :webp
Mime::Type.register "image/avif", :avif
Mime::Type.register "application/x-shockwave-flash", :swf
Mime::Type.register "application/vnd.microsoft.portable-executable", :exe