Merge pull request #3827 from 3scale/validate-special-characters-app

Add some test for custom app ids when creating applications

test/integration/provider/admin/applications/applications_controller_test.rb

@@ -200,6 +200,20 @@ def setup
         assert_response :redirect
         assert_equal subscribed_service_plan, buyer.bought_service_contracts.first.service_plan
       end
+
+      test 'crate application with special characters and numeric values' do
+        provider.settings.allow_multiple_applications!
+        subscribed_service_plan = FactoryBot.create(:service_plan, service: service)
+        buyer.bought_service_contracts.create(plan: subscribed_service_plan)
+
+        %w[9999_ {}*~KEY "%<>\[\\\]^`{|} ;=?@ !#$&\'(].each do |name|
+          post provider_admin_applications_path, params: { account_id: buyer.id,
+                                                           cinstance: { plan_id: application_plan.id, name: name } }
+
+          assert_response :redirect
+          assert_equal 'Application was successfully created.', flash[:notice], "Failed creating application with name #{name}"
+        end
+      end
     end
 
     class Edit < ProviderLoggedInTest

test/integration/user-management-api/buyers_applications_test.rb

@@ -30,6 +30,8 @@ def setup
 
     ReferrerFilter.enable_backend!
     stub_backend_get_keys
+
+    @token = FactoryBot.create(:access_token, owner: @provider.admin_users.first!, scopes: %w[account_management]).value
   end
 
   test 'index' do
@@ -254,6 +256,21 @@ def setup
     assert_equal created_app.application_id, "superawesomeid"
   end
 
+  test 'special characters in application fields' do
+    @service.update(backend_version: '2')
+    generic_params = { plan_id: @app_plan.id, access_token: @token }
+
+    %w[9999_ {}*~KEY "%<>\[\\\]^`{|} ;=?@ !#$&\'(].each do |id|
+      post admin_api_account_applications_path(account_id: @buyer.id, format: :json), params: { **generic_params, application_id: id }
+      assert_response :success
+      assert_equal id, JSON.parse(response.body)['application']['application_id']
+    end
+
+    post admin_api_account_applications_path(account_id: @buyer.id), params: { **generic_params, description: '99_'}
+    assert_response :success
+  end
+
+
   pending_test 'create errors'
 
   test 'create with extra fields' do