fix: added validation check for user credentials #228
Conversation
client/client.go
Outdated
| @@ -87,6 +87,24 @@ func (c *Client) doWithErr(req *http.Request) (*http.Response, error) { | |||
| return res, nil | |||
| } | |||
|
|
|||
| func isAlphanumeric(word string) bool { | |||
| return regexp.MustCompile(`^[a-zA-Z0-9]*$`).MatchString(word) | |||
There was a problem hiding this comment.
It's not very efficient to do this every single time someone calls isAlphanumeric - make the regexp a package level variable that gets initialized one time.
Note, I believe this will also pass if word is the empty string. It would be pretty easy to add some basic smoke tests for this function.
client/client.go
Outdated
| username, password := c.basicAuth() | ||
| err := &TwilioRestError{Status: 400} | ||
| if !isAlphanumeric(username) { | ||
| err.Message = "Invalid Username" |
There was a problem hiding this comment.
This is going to be pretty vague and confusing for end users - if I get "Invalid Username" it might not be obvious to me where the problem is, especially if e.g. the user is pulling a username from an environment variable or a web form.
Can we make the error clearer about what the problem is?
| @@ -112,6 +130,11 @@ func (c *Client) SendRequest(method string, rawURL string, data url.Values, | |||
| valueReader = strings.NewReader(data.Encode()) | |||
| } | |||
|
|
|||
| credErr := c.validateCredentials() | |||
There was a problem hiding this comment.
I believe that there are some Twilio endpoints that allow data to be retrieved without a valid username and password so it would be great to know if there is a product spec for this.
| Status: 400, | ||
| Code: 21222, | ||
| Message: "Invalid Username. Illegal chars", | ||
| MoreInfo: "https://www.twilio.com/docs/errors/21222"} |
There was a problem hiding this comment.
Added error codes and more info from error page
|
Fixes
Added check for username and Password to be alphanumeric
Checklist
If you have questions, please file a support ticket, or create a GitHub Issue in this repository.