fix: disallow invalid tag values

src/lib/openapi/spec/tag-schema.test.ts

@@ -0,0 +1,101 @@
+import { TAG_MAX_LENGTH, TAG_MIN_LENGTH } from '../../util';
+import { validateSchema } from '../validate';
+
+describe('tag value validation', () => {
+    test.each([
+        ['minimum', TAG_MIN_LENGTH],
+        ['maximum', TAG_MAX_LENGTH],
+    ])(`names with the %s length are valid`, (_, length) => {
+        const data = {
+            value: 'a'.repeat(length),
+            type: 'simple',
+        };
+
+        const validationResult = validateSchema(
+            '#/components/schemas/tagSchema',
+            data,
+        );
+
+        expect(validationResult).toBeUndefined();
+    });
+
+    test(`names can not be only whitespace`, () => {
+        const space = ' '.repeat(TAG_MIN_LENGTH);
+        const data = {
+            value: space,
+            type: 'simple',
+        };
+
+        const validationResult = validateSchema(
+            '#/components/schemas/tagSchema',
+            data,
+        );
+
+        expect(validationResult).toMatchObject({
+            errors: [{ keyword: 'pattern', instancePath: '/value' }],
+        });
+    });
+
+    test(`names must be at least ${TAG_MIN_LENGTH} characters long, not counting leading and trailing whitespace`, () => {
+        const space = ' '.repeat(TAG_MIN_LENGTH);
+        const data = {
+            value: space + 'a'.repeat(TAG_MIN_LENGTH - 1) + space,
+            type: 'simple',
+        };
+
+        const validationResult = validateSchema(
+            '#/components/schemas/tagSchema',
+            data,
+        );
+
+        expect(validationResult).toMatchObject({
+            errors: [{ keyword: 'pattern', instancePath: '/value' }],
+        });
+    });
+
+    test(`spaces within a tag value counts towards its maximum length`, () => {
+        const space = ' '.repeat(TAG_MAX_LENGTH);
+        const data = {
+            value: `a${space}z`,
+            type: 'simple',
+        };
+
+        const validationResult = validateSchema(
+            '#/components/schemas/tagSchema',
+            data,
+        );
+
+        expect(validationResult).toMatchObject({
+            errors: [{ keyword: 'pattern', instancePath: '/value' }],
+        });
+    });
+
+    test(`leading and trailing whitespace does not count towards a name's maximum length`, () => {
+        const space = ' '.repeat(TAG_MAX_LENGTH);
+        const data = {
+            value: space + 'a'.repeat(TAG_MAX_LENGTH) + space,
+            type: 'simple',
+        };
+
+        const validationResult = validateSchema(
+            '#/components/schemas/tagSchema',
+            data,
+        );
+
+        expect(validationResult).toBeUndefined();
+    });
+
+    test(`tag names can contain spaces`, () => {
+        const data = {
+            value: 'tag name with spaces',
+            type: 'simple',
+        };
+
+        const validationResult = validateSchema(
+            '#/components/schemas/tagSchema',
+            data,
+        );
+
+        expect(validationResult).toBeUndefined();
+    });
+});

src/lib/openapi/spec/tag-schema.ts

@@ -1,5 +1,5 @@
 import type { FromSchema } from 'json-schema-to-ts';
-import { TAG_MAX_LENGTH, TAG_MIN_LENGTH } from '../../services/tag-schema';
+import { TAG_MAX_LENGTH, TAG_MIN_LENGTH } from '../../util';
 
 export const tagSchema = {
     $id: '#/components/schemas/tagSchema',
@@ -11,16 +11,16 @@ export const tagSchema = {
     properties: {
         value: {
             type: 'string',
-            minLength: TAG_MIN_LENGTH,
-            maxLength: TAG_MAX_LENGTH,
-            description: 'The value of the tag',
+            pattern: `^\\s*\\S.{${TAG_MIN_LENGTH - 2},${
+                TAG_MAX_LENGTH - 2
+            }}\\S\\s*$`,
+            description: `The value of the tag. The value must be between ${TAG_MIN_LENGTH} and ${TAG_MAX_LENGTH} characters long. Leading and trailing whitespace is ignored and will be trimmed before saving the tag value.`,
             example: 'a-tag-value',
         },
         type: {
             type: 'string',
             minLength: TAG_MIN_LENGTH,
             maxLength: TAG_MAX_LENGTH,
-            default: 'simple',
             description:
                 'The [type](https://docs.getunleash.io/reference/tags#tag-types) of the tag',
             example: 'simple',

src/lib/services/tag-schema.ts

@@ -1,9 +1,8 @@
 import Joi from 'joi';
 
 import { customJoi } from '../routes/util';
+import { TAG_MAX_LENGTH, TAG_MIN_LENGTH } from '../util';
 
-export const TAG_MIN_LENGTH = 2;
-export const TAG_MAX_LENGTH = 50;
 export const tagSchema = Joi.object()
     .keys({
         value: Joi.string().min(TAG_MIN_LENGTH).max(TAG_MAX_LENGTH),

src/lib/services/tag-service.test.ts

@@ -0,0 +1,29 @@
+import type { IUnleashConfig } from '../types/option';
+import { createTestConfig } from '../../test/config/test-config';
+import type EventService from '../features/events/event-service';
+import FakeTagStore from '../../test/fixtures/fake-tag-store';
+import TagService from './tag-service';
+
+const config: IUnleashConfig = createTestConfig();
+
+test('should trim tag names before saving them', async () => {
+    const tagStore = new FakeTagStore();
+    const service = new TagService({ tagStore }, config, {
+        storeEvent: async () => {},
+    } as unknown as EventService);
+
+    await service.createTag(
+        {
+            value: '  test  ',
+            type: 'simple',
+        },
+        { id: 1, username: 'audit user', ip: '' },
+    );
+
+    expect(tagStore.tags).toMatchObject([
+        {
+            value: 'test',
+            type: 'simple',
+        },
+    ]);
+});

src/lib/services/tag-service.ts

@@ -52,7 +52,11 @@ export default class TagService {
     }
 
     async createTag(tag: ITag, auditUser: IAuditUser): Promise<ITag> {
-        const data = await this.validate(tag);
+        const trimmedTag = {
+            ...tag,
+            value: tag.value.trim(),
+        };
+        const data = await this.validate(trimmedTag);
         await this.tagStore.createTag(data);
         await this.eventService.storeEvent(
             new TagCreatedEvent({

src/lib/util/constants.ts

@@ -17,6 +17,9 @@ export const PREDEFINED_ROLE_TYPES = [ROOT_ROLE_TYPE, PROJECT_ROLE_TYPE];
 export const ROOT_ROLE_TYPES = [ROOT_ROLE_TYPE, CUSTOM_ROOT_ROLE_TYPE];
 export const PROJECT_ROLE_TYPES = [PROJECT_ROLE_TYPE, CUSTOM_PROJECT_ROLE_TYPE];
 
+export const TAG_MIN_LENGTH = 2;
+export const TAG_MAX_LENGTH = 50;
+
 /* CONTEXT FIELD OPERATORS */
 
 export const NOT_IN = 'NOT_IN';