Skip to content

fix(firestore): only reject ids that fully match __.*__ - #7856

Open
ninglinLiu wants to merge 14 commits into
google:mainfrom
ninglinLiu:fix/firestore-identity-reserved-pattern-7855
Open

ninglinLiu wants to merge 14 commits into
google:mainfrom
ninglinLiu:fix/firestore-identity-reserved-pattern-7855

Conversation

@ninglinLiu

Copy link
Copy Markdown
Contributor

Description

FirestoreSessionService._validate_identity_component rejected ids matching startswith("__") and endswith("__"). That is broader than Firestore's reserved __.*__ pattern: "__" and "___" are valid document ids (the prefix and suffix overlap), but they were rejected after #7801.

This switches the check to re.fullmatch(r"__.*__", value) so only true reserved ids are rejected.

Test plan

  • Added unit tests that "__" / "___" / "user__" / "__user" / "_x_" are accepted and "____" / "__x__" / "__reserved__" are rejected
  • Existing path-breaking identity rejection tests still pass

Fixes #7855

startswith/endswith("__") also matched "__" and "___" because the
prefix and suffix overlap, but Firestore's reserved pattern needs at
least four characters. Use re.fullmatch so those valid document ids
are accepted again.

Fixes google#7855
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

FirestoreSessionService rejects valid ids "__" and "___" as reserved

2 participants