From d1d8a7923ff20d14f7a8ee7f5256bac40b479743 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@rubenfiszel.com>
Date: Mon, 27 Mar 2023 21:07:34 +0200
Subject: [PATCH] add more sanity checks to api

---
 backend/Cargo.lock                     |  1 +
 backend/windmill-api/Cargo.toml        |  1 +
 backend/windmill-api/src/apps.rs       |  4 ++++
 backend/windmill-api/src/folders.rs    | 12 ++++++++++++
 backend/windmill-api/src/workspaces.rs |  7 ++++++-
 5 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 29aa082a83..edb797b71d 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -4781,6 +4781,7 @@ dependencies = [
  "mime_guess",
  "prometheus",
  "rand 0.8.5",
+ "regex",
  "reqwest",
  "retainer",
  "rust-embed",
diff --git a/backend/windmill-api/Cargo.toml b/backend/windmill-api/Cargo.toml
index c39f4efc46..d7e868d3a7 100644
--- a/backend/windmill-api/Cargo.toml
+++ b/backend/windmill-api/Cargo.toml
@@ -69,3 +69,4 @@ async-stripe = { workspace = true, optional = true }
 lazy_static.workspace = true
 prometheus.workspace = true
 async_zip.workspace = true
+regex.workspace = true
diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index 9c4cb54f9e..b3b61bef2a 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -320,6 +320,10 @@ async fn create_app(
     app.policy.on_behalf_of = Some(username_to_permissioned_as(&authed.username));
     app.policy.on_behalf_of_email = Some(authed.email);
 
+    if &app.path == "" {
+        return Err(Error::BadRequest("App path cannot be empty".to_string()));
+    }
+
     let id = sqlx::query_scalar!(
         "INSERT INTO app
             (workspace_id, path, summary, policy, versions)
diff --git a/backend/windmill-api/src/folders.rs b/backend/windmill-api/src/folders.rs
index 5115670e5a..51fd4bac5c 100644
--- a/backend/windmill-api/src/folders.rs
+++ b/backend/windmill-api/src/folders.rs
@@ -16,6 +16,8 @@ use axum::{
     routing::{delete, get, post},
     Json, Router,
 };
+use lazy_static::lazy_static;
+use regex::Regex;
 use windmill_audit::{audit_log, ActionKind};
 use windmill_common::{
     error::{self, to_anyhow, Error, JsonResult, Result},
@@ -136,6 +138,10 @@ async fn check_name_conflict<'c>(
     return Ok(());
 }
 
+lazy_static! {
+    static ref VALID_FOLDER_NAME: Regex = Regex::new(r#"^[a-zA-Z_0-9]+$"#).unwrap();
+}
+
 async fn create_folder(
     authed: Authed,
     Extension(user_db): Extension<UserDB>,
@@ -145,6 +151,12 @@ async fn create_folder(
 ) -> Result<String> {
     let mut tx = user_db.begin(&authed).await?;
 
+    if !VALID_FOLDER_NAME.is_match(&ng.name) {
+        return Err(windmill_common::error::Error::BadRequest(format!(
+            "Folder name can only contain alphanumeric characters, underscores"
+        )));
+    }
+
     check_name_conflict(&mut tx, &w_id, &ng.name).await?;
     let owner = username_to_permissioned_as(&authed.username);
     let owners = &ng.owners.unwrap_or(vec![owner.clone()]);
diff --git a/backend/windmill-api/src/workspaces.rs b/backend/windmill-api/src/workspaces.rs
index 049ac59e63..ff2360c46b 100644
--- a/backend/windmill-api/src/workspaces.rs
+++ b/backend/windmill-api/src/workspaces.rs
@@ -16,7 +16,7 @@ use crate::{
     db::{UserDB, DB},
     folders::Folder,
     resources::{Resource, ResourceType},
-    users::{Authed, WorkspaceInvite, NEW_USER_WEBHOOK},
+    users::{Authed, WorkspaceInvite, NEW_USER_WEBHOOK, VALID_USERNAME},
     utils::require_super_admin,
     HTTP_CLIENT,
 };
@@ -986,6 +986,11 @@ async fn add_user(
     require_admin(is_admin, &username)?;
 
     let mut tx = db.begin().await?;
+    if !VALID_USERNAME.is_match(&nu.username) {
+        return Err(windmill_common::error::Error::BadRequest(format!(
+            "Usermame can only contain alphanumeric characters and underscores"
+        )));
+    }
 
     sqlx::query!(
         "INSERT INTO usr