From 1eedcc0eb3f628491047dc7dd1fdbb3573124106 Mon Sep 17 00:00:00 2001
From: Umputun <umputun@gmail.com>
Date: Sun, 16 Aug 2020 21:12:42 -0500
Subject: [PATCH] don't allow anon with space prefix or suffix

---
 backend/app/cmd/server.go      | 10 +++++++++-
 backend/app/cmd/server_test.go | 16 ++++++++++++++--
 backend/app/rest/api/rest.go   |  2 +-
 3 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/backend/app/cmd/server.go b/backend/app/cmd/server.go
index 3c291716..34943696 100644
--- a/backend/app/cmd/server.go
+++ b/backend/app/cmd/server.go
@@ -756,6 +756,13 @@ func (s *ServerCommand) addAuthProviders(authenticator *auth.Service) error {
 		log.Print("[INFO] anonymous access enabled")
 		var isValidAnonName = regexp.MustCompile(`^[\p{L}\d_ ]+$`).MatchString
 		authenticator.AddDirectProvider("anonymous", provider.CredCheckerFunc(func(user, _ string) (ok bool, err error) {
+
+			// don't allow anon with space prefix or suffix
+			if strings.HasPrefix(user, " ") || strings.HasSuffix(user, " ") {
+				log.Printf("[WARN] name %q has space as a suffix or prefix", user)
+				return false, nil
+			}
+
 			user = strings.TrimSpace(user)
 			if len(user) < 3 {
 				log.Printf("[WARN] name %q is too short, should be at least 3 characters", user)
@@ -924,8 +931,9 @@ func (s *ServerCommand) makeAuthenticator(ds *service.DataStore, avas avatar.Sto
 					log.Printf("[WARN] can't get admins for %s, %v", c.Audience, err)
 				}
 				for _, a := range admins {
-					if strings.EqualFold(c.User.Name, a) {
+					if strings.EqualFold(strings.TrimSpace(c.User.Name), a) {
 						c.User.SetBoolAttr("blocked", true)
+						log.Printf("[INFO] blocked %+v, attempt to impersonate admin", c.User)
 						break
 					}
 				}
diff --git a/backend/app/cmd/server_test.go b/backend/app/cmd/server_test.go
index 644ce9f4..98a636da 100644
--- a/backend/app/cmd/server_test.go
+++ b/backend/app/cmd/server_test.go
@@ -147,7 +147,19 @@ func TestServerApp_AnonMode(t *testing.T) {
 	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
 
 	// try to login with short name
-	resp, err = http.Get(fmt.Sprintf("http://localhost:%d/auth/anonymous/login?user=bl%20%20&aud=remark", port))
+	resp, err = http.Get(fmt.Sprintf("http://localhost:%d/auth/anonymous/login?user=bl%%20%%20&aud=remark", port))
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	// try to login with name what have space in prefix
+	resp, err = http.Get(fmt.Sprintf("http://localhost:%d/auth/anonymous/login?user=%%20somebody&aud=remark", port))
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	// try to login with name what have space in suffix
+	resp, err = http.Get(fmt.Sprintf("http://localhost:%d/auth/anonymous/login?user=somebody%%20&aud=remark", port))
 	require.NoError(t, err)
 	defer resp.Body.Close()
 	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
@@ -160,7 +172,7 @@ func TestServerApp_AnonMode(t *testing.T) {
 	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
 
 	// try to login with admin name
-	resp, err = http.Get(fmt.Sprintf("http://localhost:%d/auth/anonymous/login?user=umputun&aud=remark", port))
+	resp, err = http.Get(fmt.Sprintf("http://localhost:%d/auth/anonymous/login?user=umpUtun&aud=remark", port))
 	require.NoError(t, err)
 	defer resp.Body.Close()
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
diff --git a/backend/app/rest/api/rest.go b/backend/app/rest/api/rest.go
index f79404fb..d34a46e8 100644
--- a/backend/app/rest/api/rest.go
+++ b/backend/app/rest/api/rest.go
@@ -209,7 +209,7 @@ func (s *Rest) routes() chi.Router {
 
 	router.Group(func(r chi.Router) {
 		r.Use(middleware.Timeout(5 * time.Second))
-		r.Use(logInfoWithBody, tollbooth_chi.LimitHandler(tollbooth.NewLimiter(5, nil)), middleware.NoCache)
+		r.Use(logInfoWithBody, tollbooth_chi.LimitHandler(tollbooth.NewLimiter(10, nil)), middleware.NoCache)
 		r.Mount("/auth", authHandler)
 	})