Merge pull request #1107 from mozilla/check-valid-subdomains

fix #1095 #1092 no spaces or special chars in subdomains

emails/models.py

@@ -2,6 +2,7 @@ from collections import namedtuple
 from datetime import datetime, timedelta, timezone
 from hashlib import sha256
 import random
+import re
 import string
 import uuid
 
@@ -49,9 +50,13 @@ class Profile(models.Model):
 
     @staticmethod
     def subdomain_available(subdomain):
+        # valid subdomains can't start or end with a hyphen, and must be 1-63
+        # alphanumeric characters and/or hyphens
+        valid_subdomain_pattern = re.compile('^(?!-)[A-Za-z0-9-]{1,63}(?<!-)$')
+        valid = valid_subdomain_pattern.match(subdomain) is not None
         bad_word = has_bad_words(subdomain)
         taken = Profile.objects.filter(subdomain=subdomain).count() > 0
-        return not bad_word and not taken
+        return valid and not bad_word and not taken
 
     @property
     def num_active_address(self):

emails/tests/models_tests.py

@@ -450,6 +450,17 @@ class ProfileTest(TestCase):
         premium_profile.add_subdomain('thisisfine')
         assert Profile.subdomain_available('thisisfine') == False
 
+    def test_subdomain_available_with_space_returns_False(self):
+        assert Profile.subdomain_available('my domain') == False
+
+    def test_subdomain_available_with_special_char_returns_False(self):
+        assert Profile.subdomain_available('my@domain') == False
+
+    def test_subdomain_available_with_dash_returns_True(self):
+        assert Profile.subdomain_available('my-domain') == True
+
+    def test_subdomain_available_with_dash_at_front_returns_False(self):
+        assert Profile.subdomain_available('-mydomain') == False
     def test_display_name_exists(self):
         display_name = 'Display Name'
         social_account = baker.make(