Skip to content

Relax group and project name validation regexes

Once #199049 and #220526 are complete, relax (and unify) the validation regexes at https://gitlab.com/gitlab-org/gitlab/-/blob/0890bda6ba241539914cd95fcc83bbcc7960c953/lib/gitlab/regex.rb#L7-26.

From discussion in the security MR for https://gitlab.com/gitlab-org/gitlab/-/issues/199049, it was discussed that maybe we should relax the regex to something like the following:

\A[\p{Alnum}\u{00A9}-\u{1f9ff}_][^\/\\\x07\x1B\f\n\r\t\v]*\z

This would keep the allowed beginning characters the same, but remove most of the limitations on the remainder of the value. The latter part of the regex prevents non-visible characters including newlines and also prevents slashes (forward and backward.

There may need to be some further consideration but in general we should avoid limiting characters unless there's a specific reason a character is unsafe.

Further considerations from discussion:

Edited by Drew Blessing