From e2d07e9760562c6032225c854ae0afebfd30807b Mon Sep 17 00:00:00 2001
From: claudemiro <dimiro1@gmail.com>
Date: Sun, 17 May 2015 09:37:51 -0300
Subject: [PATCH] Validating channel name when connecting.

---
 ipe/websockets.go   |  5 +++++
 utils/utils.go      | 15 +++++++++++++++
 utils/utils_test.go | 18 ++++++++++++++++++
 3 files changed, 38 insertions(+)

diff --git a/ipe/websockets.go b/ipe/websockets.go
index 5994e2b..c439654 100644
--- a/ipe/websockets.go
+++ b/ipe/websockets.go
@@ -118,6 +118,11 @@ func onMessage(conn *websocket.Conn, w http.ResponseWriter, r *http.Request, ses
 
 			channelName := strings.TrimSpace(subscribeEvent.Data.Channel)
 
+			if !utils.IsChannelNameValid(channelName) {
+				emitWSError(newGenericError(fmt.Sprintf("This channel name is not valid")), conn)
+				break
+			}
+
 			isPresence := strings.HasPrefix(channelName, "presence-")
 			isPrivate := strings.HasPrefix(channelName, "private-")
 
diff --git a/utils/utils.go b/utils/utils.go
index 157f40c..c628900 100644
--- a/utils/utils.go
+++ b/utils/utils.go
@@ -10,6 +10,7 @@ import (
 	"encoding/hex"
 	"fmt"
 	"math/rand"
+	"regexp"
 	"time"
 )
 
@@ -29,3 +30,17 @@ func GenerateSessionID() string {
 
 	return fmt.Sprintf("%d.%d", rand.Intn(MAX), rand.Intn(MAX))
 }
+
+func IsChannelNameValid(channelName string) bool {
+	matched, err := regexp.MatchString("^[A-Za-z0-9_\\-=@,.;]+$", channelName)
+
+	if err != nil {
+		return false
+	}
+
+	if matched {
+		return true
+	}
+
+	return false
+}
diff --git a/utils/utils_test.go b/utils/utils_test.go
index b62321b..bd99e88 100644
--- a/utils/utils_test.go
+++ b/utils/utils_test.go
@@ -18,3 +18,21 @@ func TestGenerateSession(t *testing.T) {
 		t.Errorf("Must match ^\\d+\\.\\d+$, value: '%s'", sessionID)
 	}
 }
+
+func TestIsValidChannelName(t *testing.T) {
+	if IsChannelNameValid("#@#hhh**sasas") {
+		t.Errorf("Invalid Channel Name")
+	}
+
+	if !IsChannelNameValid("private-hello") {
+		t.Errorf("Must be Valid Channel Name")
+	}
+
+	if !IsChannelNameValid("presence-hello") {
+		t.Errorf("Must be Valid Channel Name")
+	}
+
+	if !IsChannelNameValid("public") {
+		t.Errorf("Must be Valid Channel Name")
+	}
+}