From c5b6e641a45f79d82c463654e18d06f51cf08d7c Mon Sep 17 00:00:00 2001
From: qdequele <quentin@dequelen.me>
Date: Thu, 5 Mar 2020 11:44:30 +0100
Subject: [PATCH] index UID format; fix #497

---
 meilisearch-http/src/error.rs              |  5 ++
 meilisearch-http/src/routes/index.rs       |  8 +++-
 meilisearch-http/tests/documents_delete.rs |  2 +
 meilisearch-http/tests/index.rs            | 54 +++++++++++++++++++++-
 4 files changed, 67 insertions(+), 2 deletions(-)

diff --git a/meilisearch-http/src/error.rs b/meilisearch-http/src/error.rs
index a2b539687..9c1a91a4e 100644
--- a/meilisearch-http/src/error.rs
+++ b/meilisearch-http/src/error.rs
@@ -22,6 +22,7 @@ pub enum ResponseError {
     BadParameter(String, String),
     OpenIndex(String),
     CreateIndex(String),
+    InvalidIndexUid,
     Maintenance,
 }
 
@@ -108,6 +109,10 @@ impl IntoResponse for ResponseError {
                 format!("Impossible to open index; {}", err),
                 StatusCode::BAD_REQUEST,
             ),
+            ResponseError::InvalidIndexUid => error(
+                "Index must have a valid uid; Index uid can be of type integer or string only composed of alphanumeric characters, hyphens (-) and underscores (_).".to_string(),
+                StatusCode::BAD_REQUEST,
+            ),
             ResponseError::Maintenance => error(
                 String::from("Server is in maintenance, please try again later"),
                 StatusCode::SERVICE_UNAVAILABLE,
diff --git a/meilisearch-http/src/routes/index.rs b/meilisearch-http/src/routes/index.rs
index 6625d24c3..b8adbb531 100644
--- a/meilisearch-http/src/routes/index.rs
+++ b/meilisearch-http/src/routes/index.rs
@@ -138,7 +138,13 @@ pub async fn create_index(mut ctx: Request<Data>) -> SResult<Response> {
     let db = &ctx.state().db;
 
     let uid = match body.uid {
-        Some(uid) => uid,
+        Some(uid) => {
+            if uid.chars().all(|x| x.is_ascii_alphanumeric() || x == '-' || x == '_') {
+                uid
+            } else {
+                return Err(ResponseError::InvalidIndexUid)
+            }
+        },
         None => loop {
             let uid = generate_uid();
             if db.open_index(&uid).is_none() {
diff --git a/meilisearch-http/tests/documents_delete.rs b/meilisearch-http/tests/documents_delete.rs
index 02017aaf1..35041e023 100644
--- a/meilisearch-http/tests/documents_delete.rs
+++ b/meilisearch-http/tests/documents_delete.rs
@@ -14,6 +14,8 @@ fn delete() {
     assert_eq!(status_code, 404);
 }
 
+
+// Resolve teh issue https://github.com/meilisearch/MeiliSearch/issues/493
 #[test]
 fn delete_batch() {
     let mut server = common::Server::with_uid("movies");
diff --git a/meilisearch-http/tests/index.rs b/meilisearch-http/tests/index.rs
index b637134a7..4bb173e5e 100644
--- a/meilisearch-http/tests/index.rs
+++ b/meilisearch-http/tests/index.rs
@@ -470,8 +470,10 @@ fn create_index_failed() {
 }
 
 
+
+// Resolve issue https://github.com/meilisearch/MeiliSearch/issues/492
 #[test]
-fn create_index_with_identifier() {
+fn create_index_with_identifier_and_index() {
     let mut server = common::Server::with_uid("movies");
 
     let body = json!({
@@ -498,3 +500,53 @@ fn create_index_with_identifier() {
 
     assert_json_eq!(response, expect, ordered: false);
 }
+
+// Resolve issue https://github.com/meilisearch/MeiliSearch/issues/497
+#[test]
+fn create_index_with_invalid_uid() {
+    let mut server = common::Server::with_uid("");
+
+    let body = json!({
+        "uid": "the movies"
+    });
+
+    let (response, status_code) = server.create_index(body);
+    assert_eq!(status_code, 400);
+
+    let message = response["message"].as_str().unwrap();
+    assert_eq!(response.as_object().unwrap().len(), 1);
+    assert_eq!(message, "Index must have a valid uid; Index uid can be of type integer or string only composed of alphanumeric characters, hyphens (-) and underscores (_).");
+
+    let body = json!({
+        "uid": "%$#"
+    });
+
+    let (response, status_code) = server.create_index(body);
+    assert_eq!(status_code, 400);
+
+    let message = response["message"].as_str().unwrap();
+    assert_eq!(response.as_object().unwrap().len(), 1);
+    assert_eq!(message, "Index must have a valid uid; Index uid can be of type integer or string only composed of alphanumeric characters, hyphens (-) and underscores (_).");
+
+    let body = json!({
+        "uid": "the~movies"
+    });
+
+    let (response, status_code) = server.create_index(body);
+    assert_eq!(status_code, 400);
+
+    let message = response["message"].as_str().unwrap();
+    assert_eq!(response.as_object().unwrap().len(), 1);
+    assert_eq!(message, "Index must have a valid uid; Index uid can be of type integer or string only composed of alphanumeric characters, hyphens (-) and underscores (_).");
+
+    let body = json!({
+        "uid": "🎉"
+    });
+
+    let (response, status_code) = server.create_index(body);
+    assert_eq!(status_code, 400);
+
+    let message = response["message"].as_str().unwrap();
+    assert_eq!(response.as_object().unwrap().len(), 1);
+    assert_eq!(message, "Index must have a valid uid; Index uid can be of type integer or string only composed of alphanumeric characters, hyphens (-) and underscores (_).");
+}