From 0455d60994fe3dd8d9f9220b3cd7d6f6207208b2 Mon Sep 17 00:00:00 2001
From: Benoit TELLIER <btellier@linagora.com>
Date: Tue, 22 Oct 2024 14:27:48 +0200
Subject: [PATCH] JAMES-2128 Ensure creating #user is forbidden

---
 .../java/org/apache/james/mailbox/model/MailboxPath.java    | 6 ++++--
 .../resources/org/apache/james/imap/scripts/Create.test     | 3 +++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/mailbox/api/src/main/java/org/apache/james/mailbox/model/MailboxPath.java b/mailbox/api/src/main/java/org/apache/james/mailbox/model/MailboxPath.java
index d43641de5de..24abfdad667 100644
--- a/mailbox/api/src/main/java/org/apache/james/mailbox/model/MailboxPath.java
+++ b/mailbox/api/src/main/java/org/apache/james/mailbox/model/MailboxPath.java
@@ -154,7 +154,9 @@ public String getName() {
     }
 
     public boolean belongsTo(MailboxSession mailboxSession) {
-        return user.equals(mailboxSession.getUser());
+        return Optional.ofNullable(user)
+            .map(mailboxSession.getUser()::equals)
+            .orElse(false);
     }
 
     public MailboxPath child(String childName, char delimiter) {
@@ -255,7 +257,7 @@ boolean hasEmptyNameInHierarchy(char pathDelimiter) {
     }
 
     public String asString() {
-        return namespace + ":" + user.asString() + ":" + name;
+        return namespace + ":" + Optional.ofNullable(user).map(Username::asString).orElse("") + ":" + name;
     }
 
     public String asEscapedString() {
diff --git a/mpt/impl/imap-mailbox/core/src/main/resources/org/apache/james/imap/scripts/Create.test b/mpt/impl/imap-mailbox/core/src/main/resources/org/apache/james/imap/scripts/Create.test
index 4f47c8b1fb4..438e4d890f8 100644
--- a/mpt/impl/imap-mailbox/core/src/main/resources/org/apache/james/imap/scripts/Create.test
+++ b/mpt/impl/imap-mailbox/core/src/main/resources/org/apache/james/imap/scripts/Create.test
@@ -73,6 +73,9 @@ S: \* LIST \(\\HasChildren\) "." "one"
 S: \* LIST \(\\HasNoChildren\) "." "one.two"
 S: 21 OK LIST completed.
 
+C: 22 CREATE #user
+S: 22 NO CREATE processing failed.
+
 # Cleanup
 C: a1 DELETE test1.subfolder1
 S: a1 OK DELETE completed.