Skip to content

Improper input validation #81

Closed
@metacosm

Description

@metacosm

Bug Report

It's currently possible to generate code that will not compile because of invalid characters in the package name. Currently, the package name is derived from the provided domain name during the init command. However, it's feasible to use a valid domain name that will result in an invalid Java package name (for example: foo-bar.com).

What did you do?

operator-sdk init --plugins quarkus --domain foo-bar.com --project-name foo, followed by a create api call will result in invalid code:

Failed to execute goal io.quarkus:quarkus-maven-plugin:2.7.5.Final:dev (default-cli) on project foo: Unable to execute mojo: Compilation failure:
[ERROR] /tmp/src/main/java/com/foo-bar/FooReconciler.java:[1,16] ';' expected
[ERROR] /tmp/src/main/java/com/foo-bar/Foo.java:[1,16] ';' expected
[ERROR] /tmp/src/main/java/com/foo-bar/FooStatus.java:[1,16] ';' expected
[ERROR] /tmp/src/main/java/com/foo-bar/FooSpec.java:[1,16] ';' expected

This happens because - is not an accepted character in Java package names.

Possible solution

The domain name should be sanitized to ensure valid Java package names are derived from it. If sanitization occurred, a message should be output to the user.

Alternatively, it should be possible for a user to override the package name using a command line option

Metadata

Metadata

Assignees

Labels

kind/bugCategorizes issue or PR as related to a bug.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions