Added form validation on username. Fixes #2489.

tests/unit/accounts/test_forms.py

@@ -311,6 +311,28 @@ def test_username_exists(self):
             "Please choose a different username."
         )
 
+    @pytest.mark.parametrize("username", ['_foo', 'bar_', 'foo^bar'])
+    def test_username_is_valid(self, username):
+        form = forms.RegistrationForm(
+            data={"username": username},
+            user_service=pretend.stub(
+                find_userid=pretend.call_recorder(lambda _: None),
+            ),
+            recaptcha_service=pretend.stub(
+                enabled=False,
+                verify_response=pretend.call_recorder(lambda _: None),
+            ),
+        )
+        assert not form.validate()
+        assert (
+            form.username.errors.pop() ==
+            "The username is invalid. Usernames "
+            "must be composed of letters, numbers, "
+            "dots, hyphens and underscores. And must "
+            "also start and finish with a letter or number. "
+            "Please choose a different username."
+        )
+
     def test_password_strength(self):
         cases = (
             ("foobar", False),

warehouse/accounts/forms.py

@@ -29,6 +29,18 @@ class CredentialsMixin:
                     "a username with under 50 characters."
                 )
             ),
+            # the regexp below must match the CheckConstraint
+            # for the username field in accounts.models.User
+            wtforms.validators.Regexp(
+                r'^[a-zA-Z0-9][a-zA-Z0-9._-]*[a-zA-Z0-9]$',
+                message=(
+                    "The username is invalid. Usernames "
+                    "must be composed of letters, numbers, "
+                    "dots, hyphens and underscores. And must "
+                    "also start and finish with a letter or number. "
+                    "Please choose a different username."
+                )
+            )
         ],
     )