A flounder_test.go

@@ -0,0 +1,16 @@
+package main
+
+import "testing"
+
+func TestIsOKUsername(t *testing.T) {
+	for _, u := range []string{"www", "proxy", "%", "", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"} {
+		if isOkUsername(u) == nil {
+			t.Errorf("Username " + u + " should be considered invalid, but wasn't")
+		}
+	}
+	for _, u := range []string{"-", "alex", "1"} {
+		if isOkUsername(u) != nil {
+			t.Errorf("Username " + u + " should be considered valid, but wasn't")
+		}
+	}
+}

M http.go → http.go

@@ -434,6 +434,8 @@ }
 
 const ok = "-0123456789abcdefghijklmnopqrstuvwxyz"
 
+var bannedUsernames = []string{"www", "proxy", "grafana"}
+
 func isOkUsername(s string) error {
 	if len(s) < 1 {
 		return fmt.Errorf("Username is too short")
@@ -446,8 +448,14 @@ if !strings.Contains(ok, strings.ToLower(string(char))) {
 			return fmt.Errorf("Username contains invalid characters. Valid characters include lowercase letters, numbers, and hyphens.")
 		}
 	}
+	for _, username := range bannedUsernames {
+		if username == s {
+			return fmt.Errorf("Username is not allowed.")
+		}
+	}
 	return nil
 }
+
 func registerHandler(w http.ResponseWriter, r *http.Request) {
 	if r.Method == "GET" {
 		data := struct {