validators: apply username validator to prevent bad values beeing searched in DB, and potential XSS payload sent via validators.

rhodecode/model/validation_schema/schemas/repo_group_schema.py

@@ -22,6 +22,7 b''
 import colander
 import deform.widget
 
+from rhodecode.model.validation_schema.utils import username_converter
 from rhodecode.translation import _
 from rhodecode.model.validation_schema import validators, preparers, types
 
@@ -120,6 +121,7 b' def deferred_repo_group_owner_validator('
 
     def repo_owner_validator(node, value):
         from rhodecode.model.db import User
+        value = username_converter(value)
         existing = User.get_by_username(value)
         if not existing:
             msg = _(u'Repo group owner with id `{}` does not exists').format(

rhodecode/model/validation_schema/schemas/repo_schema.py

@@ -22,7 +22,7 b' import colander'
 import deform.widget
 
 from rhodecode.translation import _
-from rhodecode.model.validation_schema.utils import convert_to_optgroup
+from rhodecode.model.validation_schema.utils import convert_to_optgroup, username_converter
 from rhodecode.model.validation_schema import validators, preparers, types
 
 DEFAULT_LANDING_REF = 'rev:tip'
@@ -55,6 +55,7 b' def deferred_repo_owner_validator(node, '
 
     def repo_owner_validator(node, value):
         from rhodecode.model.db import User
+        value = username_converter(value)
         existing = User.get_by_username(value)
         if not existing:
             msg = _(u'Repo owner with id `{}` does not exists').format(value)

rhodecode/model/validation_schema/schemas/user_group_schema.py

@@ -21,6 +21,7 b' import re'
 import colander
 
 from rhodecode.model.validation_schema import types, validators
+from rhodecode.model.validation_schema.utils import username_converter
 from rhodecode.translation import _
 
 
@@ -43,6 +44,7 b' def deferred_user_group_owner_validator('
 
     def owner_validator(node, value):
         from rhodecode.model.db import User
+        value = username_converter(value)
         existing = User.get_by_username(value)
         if not existing:
             msg = _(u'User group owner with id `{}` does not exists').format(value)

rhodecode/model/validation_schema/utils.py

@@ -47,3 +47,10 b' def convert_to_optgroup(items):'
             result.append((value, label))
 
     return result
+
+
+def username_converter(value):
+    for noise in ('/', ',', '*', '"', "'", '<', '>', '(', ')', '[', ']', ';'):
+        value = value.replace(noise, '')
+
+    return value