From f45fbe8fbe18204e24aa3e42f338d486f3ac64a8 Mon Sep 17 00:00:00 2001
From: Matthias Jaros <jarlucmat@mailbox.org>
Date: Wed, 12 Aug 2026 21:44:39 +0200
Subject: Added user validation regex

---
 src/env  | 13 ++++++++-----
 src/init | 18 ++++++++++++------
 2 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/src/env b/src/env
index 0a2a968..42cb089 100644
--- a/src/env
+++ b/src/env
@@ -1,10 +1,13 @@
 #!/usr/bin/env fish
 
-set _REPO_PERMISSIONS_FILE /etc/repo-permissions
-set _REPO_VALIDATION_REGEX "((?:\/[a-zA-Z0-9_\-\.]+)+.git)"
-set _GIT_VALIDATION_REGEX "^(git-(?:upload-pack|receive-pack|upload-archive)) '$_REPO_VALIDATION_REGEX'\$"
+set _BANNER (string collect < (status dirname)/banner)
+set _VERSION (string collect < (status dirname)/version)
+
 set _GIT_SUDO_GROUP gitsudo
 set _LOG /var/log/git-run
 set _PERMISSIONS r w
-set _VERSION (string collect < (status dirname)/version)
-set _BANNER (string collect < (status dirname)/banner)
+
+set _REPO_PERMISSIONS_FILE /etc/repo-permissions
+set _REPO_VALIDATION_REGEX "((?:\/[a-zA-Z0-9_\-\.]+)+.git)"
+set _GIT_VALIDATION_REGEX "^(git-(?:upload-pack|receive-pack|upload-archive)) '$_REPO_VALIDATION_REGEX'\$"
+set _USER_VALIDATION_REGEX "^[a-z0-9]([a-z0-9_-]{0,30}[a-z0-9])?\$"
diff --git a/src/init b/src/init
index d82f7a3..383d1c1 100755
--- a/src/init
+++ b/src/init
@@ -16,9 +16,9 @@ function fail
     return 1
 end
 
-function checkUser
+function doesUserExist
 	set -l user $argv[1]
-	grep -q -E "^$user:" < /etc/passwd
+	string match -q -r -- "^$user:" < /etc/passwd
 	return $status
 end
 
@@ -26,16 +26,22 @@ function setupUser
 	set -l userConfig (string split ':' $argv[1])
 	set -l user $userConfig[1]
 	set -l key $userConfig[2]
-	set -l HOME "/home/$user"
+
+	# validate username
+	if not string match -q -r -- $_USER_VALIDATION_REGEX "$user"
+		echo "Error: User '$user' does not match validation regex"
+		return 1
+	end
 
 	echo "Setting up user: $user"
 	if [ "$user" = git ]
 		echo "Error: User git is reserved"
-		return 1
+		return 2
 	end
 	
+	set -l HOME "/home/$user"
 	# setup user exist if necessary
-	if not checkUser "$user"
+	if not doesUserExist "$user"
 		# user is not restricted, this is done in ssh config with forceCommand
 		# we need to be able to run a fish script to check for permissions
 		adduser --home $HOME -D "$user"; or fail "Failed to create user $user"
@@ -54,7 +60,7 @@ function setupUser
 end
 
 function setupGitUser
-	checkUser "git"; and return 0
+	doesUserExist "git"; and return 0
 	echo "Setting up git user"
 	# git user has read/write access to all repos, set git-shell
 	# and no password login allowed -> no ssh login possible
-- 
cgit v1.3.1