From 83ba6b64c90c2dcff4aaace933dbfc92318ceee5 Mon Sep 17 00:00:00 2001
From: Jacob Herrington <jacobherringtondeveloper@gmail.com>
Date: Wed, 1 Jul 2020 04:48:25 -0500
Subject: [PATCH] Stop allowing accented characters in tags (#9006)

* Stop allowing accented characters in tags

This commit will add strict frontend and backend validation for tags
disallowing accented characters.

* Update tags validation error message

* Add more character sets to tag validation spec
---
 app/javascript/shared/components/tags.jsx |  1 +
 app/models/tag.rb                         |  5 ++++-
 spec/models/tag_spec.rb                   | 17 +++++++++++++++++
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/app/javascript/shared/components/tags.jsx b/app/javascript/shared/components/tags.jsx
index 74fc6b65d..e4c837178 100644
--- a/app/javascript/shared/components/tags.jsx
+++ b/app/javascript/shared/components/tags.jsx
@@ -449,6 +449,7 @@ class Tags extends Component {
           onKeyDown={this.handleKeyDown}
           onBlur={this.handleFocusChange}
           onFocus={onFocus}
+          pattern={`${LETTERS_NUMBERS}`}
         />
         {searchResultsHTML}
       </div>
diff --git a/app/models/tag.rb b/app/models/tag.rb
index fbcdbb2f9..798e3f82a 100644
--- a/app/models/tag.rb
+++ b/app/models/tag.rb
@@ -82,7 +82,10 @@ class Tag < ActsAsTaggableOn::Tag
 
   def validate_name
     errors.add(:name, "is too long (maximum is 30 characters)") if name.length > 30
-    errors.add(:name, "contains non-alphanumeric characters") unless name.match?(/\A[[:alnum:]]+\z/)
+    # [:alnum:] is not used here because it supports diacritical characters.
+    # If we decide to allow diacritics in the future, we should replace the
+    # following regex with [:alnum:].
+    errors.add(:name, "contains non-ASCII characters") unless name.match?(/\A[[a-z0-9]]+\z/i)
   end
 
   def mod_chat_channel
diff --git a/spec/models/tag_spec.rb b/spec/models/tag_spec.rb
index 58cd0c33c..78a524479 100644
--- a/spec/models/tag_spec.rb
+++ b/spec/models/tag_spec.rb
@@ -46,6 +46,23 @@ RSpec.describe Tag, type: :model do
         tag.name = nil
         expect(tag).not_to be_valid
       end
+
+      it "fails validations if name uses non-ASCII characters" do
+        tag.name = "مرحبا"
+        expect(tag).not_to be_valid
+
+        tag.name = "你好"
+        expect(tag).not_to be_valid
+
+        tag.name = "Cześć"
+        expect(tag).not_to be_valid
+
+        tag.name = "♩ ♪ ♫ ♬ ♭ ♮ ♯"
+        expect(tag).not_to be_valid
+
+        tag.name = "Test™"
+        expect(tag).not_to be_valid
+      end
     end
 
     describe "alias_for" do