Groups with space at the beginning or end of the name can be created with the Provisioning API

[phil-davis]

Describe the bug

core PR https://github.com/owncloud/core/pull/39540 is improving/changing the group name validation in core. oCIS should behave the same - there should not be any space allowed at the beginning and/or end of a group name.

Steps to reproduce

Run the related new API tests:

apiProvisioningGroups-v1/addGroup.feature:158
apiProvisioningGroups-v1/addGroup.feature:166
apiProvisioningGroups-v1/addGroup.feature:174
apiProvisioningGroups-v2/addGroup.feature:154
apiProvisioningGroups-v2/addGroup.feature:162
apiProvisioningGroups-v2/addGroup.feature:170

Expected behavior

Groups with space at the start or end of the name should not be allowed to be created: " space-at-start" "space-at-end " " " Those should all be prohibited group names.

Actual behavior

Those names can be use when creating a group with the Provisioning API.

Setup

Current ocis master.

[ScharfViktor]

Groups with space at the start or end of the name should not be allowed to be created: " space-at-start" "space-at-end "

why? I tested it on ocis-6.0.0 using graph/v1.0/groups - it's possible to create with space at the beginning or end of the name

@rhafer should we forbid it or close issue?

[phil-davis]

why?

In oC10 this was discussed and it was decided that "accidents" like having a group called "finance" and another group called "finance " (with a space at the end) caused confusion, and are never intentional in real-life. ocis can, of course, decide if it wants such a limitation or not.

[micbar]

@rhafer What is your opinion?

[rhafer]

I agree that we should not allow trailing or leading spaces in group names. It's just confusing.

[dragonchaser]

Would it be valid to just trim the name when validating the input or should there be a hard error (like 400)?

[phil-davis]

Would it be valid to just trim the name when validating the input or should there be a hard error (like 400)?

I like the idea of auto-trimming. And then if the group already exists, an error about that will be returned. (e.g. "finance" already exists, someone tries to create "finance ", they get an error back saying "finance" already exists.

But for non-human clients - the actual code making API requests - if it sends a request to create group "HR ", gets a success response, then it will think that "HR " now exists. But actually "HR" was created. The client application is going to get confused.