Relax group and project name validation regexes
Once #199049 and #220526 are complete, relax (and unify) the validation regexes at https://gitlab.com/gitlab-org/gitlab/-/blob/0890bda6ba241539914cd95fcc83bbcc7960c953/lib/gitlab/regex.rb#L7-26.
From discussion in the security MR for https://gitlab.com/gitlab-org/gitlab/-/issues/199049, it was discussed that maybe we should relax the regex to something like the following:
\A[\p{Alnum}\u{00A9}-\u{1f9ff}_][^\/\\\x07\x1B\f\n\r\t\v]*\z
This would keep the allowed beginning characters the same, but remove most of the limitations on the remainder of the value. The latter part of the regex prevents non-visible characters including newlines and also prevents slashes (forward and backward.
There may need to be some further consideration but in general we should avoid limiting characters unless there's a specific reason a character is unsafe.
Further considerations from discussion:
- Ensure allowed special chars work with Pages (URLs)
- Only affect when name is changed (don't validate existing names that wouldn't match the regex)
- Per https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/572#note_358203267, once we relax the regex we should explicitly test that an
&
gets passed through unencoded. - Ensure
+
is allowed.