From 1bb9d32ea06af8777e3f27438ad81b0a72905821 Mon Sep 17 00:00:00 2001
From: UGilfoyle <akashkaintura.ak@gmail.com>
Date: Sat, 22 Aug 2026 14:40:28 +0530
Subject: [PATCH] fix: allow apostrophes in validatePersonName and unit tests

---
 packages/utils/package.json             |   4 +-
 packages/utils/src/validation.ts        |  10 +-
 packages/utils/tests/validation.test.ts | 151 ++++++++++++++++++++++++
 pnpm-lock.yaml                          |   4 +
 4 files changed, 164 insertions(+), 5 deletions(-)
 create mode 100644 packages/utils/tests/validation.test.ts

diff --git a/packages/utils/package.json b/packages/utils/package.json
index 2dc85cda7fb..286ec8ced7b 100644
--- a/packages/utils/package.json
+++ b/packages/utils/package.json
@@ -15,6 +15,7 @@
   "scripts": {
     "build": "tsdown",
     "dev": "tsdown --watch --no-clean",
+    "test": "vitest run",
     "check:lint": "oxlint --max-warnings=38 .",
     "check:types": "tsc --noEmit",
     "check:format": "oxfmt --check .",
@@ -53,6 +54,7 @@
     "@types/react": "catalog:",
     "@types/sanitize-html": "catalog:",
     "tsdown": "catalog:",
-    "typescript": "catalog:"
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   }
 }
diff --git a/packages/utils/src/validation.ts b/packages/utils/src/validation.ts
index 2b61a4a54d5..d9ab493dcb2 100644
--- a/packages/utils/src/validation.ts
+++ b/packages/utils/src/validation.ts
@@ -78,8 +78,8 @@ export const validatePersonName = (name: string): boolean | string => {
     return "Name must be 50 characters or less";
   }
 
-  if (hasInjectionRiskChars(name)) {
-    return "Names cannot contain special characters like < > ' \" { } [ ] * ^ ! # %";
+  if (hasInjectionRiskChars(name, { allowApostrophe: true })) {
+    return 'Names cannot contain special characters like < > " { } [ ] * ^ ! # %';
   }
 
   if (!PERSON_NAME_REGEX.test(name)) {
@@ -219,12 +219,14 @@ export const validateSlug = (slug: string): boolean | string => {
 /**
  * @description Checks if a string contains any injection-risk characters
  * @param {string} input - String to check
+ * @param {boolean} [options.allowApostrophe=false] - Whether to allow apostrophes (e.g. for person names)
  * @returns {boolean} true if injection-risk characters found
  * @example
  * hasInjectionRiskChars("Hello World") // returns false
  * hasInjectionRiskChars("Hello<script>") // returns true
+ * hasInjectionRiskChars("O'Brien", { allowApostrophe: true }) // returns false
  */
-export const hasInjectionRiskChars = (input: string): boolean => {
-  const injectionRiskPattern = /[<>'"{}[\]*^!#%]/;
+export const hasInjectionRiskChars = (input: string, options?: { allowApostrophe?: boolean }): boolean => {
+  const injectionRiskPattern = options?.allowApostrophe ? /[<>"{}*^!#%[\]]/ : /[<>'"{}[\]*^!#%]/;
   return injectionRiskPattern.test(input);
 };
diff --git a/packages/utils/tests/validation.test.ts b/packages/utils/tests/validation.test.ts
new file mode 100644
index 00000000000..f4ca662879a
--- /dev/null
+++ b/packages/utils/tests/validation.test.ts
@@ -0,0 +1,151 @@
+/**
+ * Copyright (c) 2023-present Plane Software, Inc. and contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ * See the LICENSE file for details.
+ */
+
+import { describe, expect, it } from "vitest";
+import {
+  hasInjectionRiskChars,
+  validateCompanyName,
+  validateDisplayName,
+  validatePersonName,
+  validateSlug,
+  validateWorkspaceName,
+} from "../src/validation";
+
+describe("validatePersonName", () => {
+  it("should accept valid standard names", () => {
+    expect(validatePersonName("John")).toBe(true);
+    expect(validatePersonName("Jane Doe")).toBe(true);
+    expect(validatePersonName("Jean-Paul")).toBe(true);
+    expect(validatePersonName("Mary-Jane Watson-Parker")).toBe(true);
+  });
+
+  it("should accept valid international names with apostrophes", () => {
+    expect(validatePersonName("O'Brien")).toBe(true);
+    expect(validatePersonName("D'Angelo")).toBe(true);
+    expect(validatePersonName("O'Connor")).toBe(true);
+    expect(validatePersonName("N'Golo")).toBe(true);
+    expect(validatePersonName("D'Souza")).toBe(true);
+  });
+
+  it("should accept international names with Unicode characters", () => {
+    expect(validatePersonName("José")).toBe(true);
+    expect(validatePersonName("Müller")).toBe(true);
+    expect(validatePersonName("李明")).toBe(true);
+    expect(validatePersonName("محمد")).toBe(true);
+    expect(validatePersonName("Александр")).toBe(true);
+    expect(validatePersonName("Åse")).toBe(true);
+  });
+
+  it("should reject empty or whitespace-only names", () => {
+    expect(validatePersonName("")).toBe("Name is required");
+    expect(validatePersonName("   ")).toBe("Name is required");
+  });
+
+  it("should reject names that exceed 50 characters", () => {
+    const longName = "A".repeat(51);
+    expect(validatePersonName(longName)).toBe("Name must be 50 characters or less");
+  });
+
+  it("should reject names containing injection characters with dedicated injection message", () => {
+    expect(validatePersonName("John<script>")).toBe(
+      'Names cannot contain special characters like < > " { } [ ] * ^ ! # %'
+    );
+    expect(validatePersonName("John{admin}")).toBe(
+      'Names cannot contain special characters like < > " { } [ ] * ^ ! # %'
+    );
+    expect(validatePersonName("John*")).toBe('Names cannot contain special characters like < > " { } [ ] * ^ ! # %');
+    expect(validatePersonName("John#1")).toBe('Names cannot contain special characters like < > " { } [ ] * ^ ! # %');
+  });
+
+  it("should reject names with numbers or unauthorized characters with format message", () => {
+    expect(validatePersonName("John123")).toBe("Names can only contain letters, spaces, hyphens, and apostrophes");
+    expect(validatePersonName("John Doe @ Work")).toBe(
+      "Names can only contain letters, spaces, hyphens, and apostrophes"
+    );
+    expect(validatePersonName("Robert); DROP TABLE Students;--")).toBe(
+      "Names can only contain letters, spaces, hyphens, and apostrophes"
+    );
+  });
+});
+
+describe("validateDisplayName", () => {
+  it("should accept valid usernames and display names", () => {
+    expect(validateDisplayName("john_doe")).toBe(true);
+    expect(validateDisplayName("john.doe-123")).toBe(true);
+    expect(validateDisplayName("josé_123")).toBe(true);
+    expect(validateDisplayName("李明.dev")).toBe(true);
+  });
+
+  it("should allow empty display names as it is optional", () => {
+    expect(validateDisplayName("")).toBe(true);
+    expect(validateDisplayName("   ")).toBe(true);
+  });
+
+  it("should reject display names with spaces or injection characters", () => {
+    expect(validateDisplayName("john doe")).toBe(
+      "Display name can only contain letters, numbers, periods, hyphens, and underscores"
+    );
+    expect(validateDisplayName("john<script>")).toBe(
+      "Display name cannot contain special characters like < > ' \" { } [ ] * ^ ! # %"
+    );
+  });
+});
+
+describe("validateCompanyName & validateWorkspaceName", () => {
+  it("should accept valid company and workspace names", () => {
+    expect(validateCompanyName("Acme Corp")).toBe(true);
+    expect(validateCompanyName("Acme_Corp-123")).toBe(true);
+    expect(validateWorkspaceName("My Workspace")).toBe(true);
+    expect(validateWorkspaceName("Société Générale")).toBe(true);
+  });
+
+  it("should reject names containing injection characters", () => {
+    expect(validateCompanyName("Acme{Corp}")).toBe(
+      "Company name cannot contain special characters like < > ' \" { } [ ] * ^ ! # %"
+    );
+    expect(validateWorkspaceName("Work<space>")).toBe(
+      "Workspace name cannot contain special characters like < > ' \" { } [ ] * ^ ! # %"
+    );
+  });
+
+  it("should reject names without any alphanumeric characters", () => {
+    expect(validateCompanyName("---___---", true)).toBe("Company name must contain at least one letter or number");
+    expect(validateWorkspaceName("---___---", true)).toBe("Workspace name must contain at least one letter or number");
+  });
+});
+
+describe("validateSlug", () => {
+  it("should accept valid slugs", () => {
+    expect(validateSlug("my-workspace")).toBe(true);
+    expect(validateSlug("my_workspace_123")).toBe(true);
+    expect(validateSlug("josé-workspace")).toBe(true);
+  });
+
+  it("should reject spaces, injection chars, and special symbols", () => {
+    expect(validateSlug("my workspace")).toBe("Slug can only contain letters, numbers, hyphens, and underscores");
+    expect(validateSlug("slug<script>")).toBe("Slug cannot contain special characters like < > ' \" { } [ ] * ^ ! # %");
+  });
+});
+
+describe("hasInjectionRiskChars", () => {
+  it("should return false for safe strings without injection characters", () => {
+    expect(hasInjectionRiskChars("Hello World")).toBe(false);
+    expect(hasInjectionRiskChars("my-workspace-123")).toBe(false);
+  });
+
+  it("should return true for strings containing injection characters", () => {
+    expect(hasInjectionRiskChars("Hello<script>")).toBe(true);
+    expect(hasInjectionRiskChars("user' OR '1'='1")).toBe(true);
+    expect(hasInjectionRiskChars("${inject}")).toBe(true);
+    expect(hasInjectionRiskChars("array[0]")).toBe(true);
+  });
+
+  it("should allow apostrophes when allowApostrophe option is true", () => {
+    expect(hasInjectionRiskChars("O'Brien", { allowApostrophe: true })).toBe(false);
+    expect(hasInjectionRiskChars("D'Angelo", { allowApostrophe: true })).toBe(false);
+    expect(hasInjectionRiskChars("O'Brien<script>", { allowApostrophe: true })).toBe(true);
+  });
+});
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index bbf11e23d18..cbc0e9b10fa 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1975,6 +1975,9 @@ importers:
       typescript:
         specifier: 5.8.3
         version: 5.8.3
+      vitest:
+        specifier: 'catalog:'
+        version: 4.1.8(@opentelemetry/api@1.9.1)(@types/node@22.12.0)(@vitest/coverage-v8@4.1.8)(vite@8.0.16(@types/node@22.12.0)(esbuild@0.28.1)(jiti@2.7.0)(terser@5.43.1)(tsx@4.20.6)(yaml@2.8.3))
 
 packages:
 
@@ -6010,6 +6013,7 @@ packages:
 
   crypto-js@4.2.0:
     resolution: {integrity: sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q==}
+    deprecated: Active development of CryptoJS has been discontinued. This library is no longer maintained.
 
   css-loader@7.1.4:
     resolution: {integrity: sha512-vv3J9tlOl04WjiMvHQI/9tmIrCxVrj6PFbHemBB1iihpeRbi/I4h033eoFIhwxBBqLhI0KYFS7yvynBFhIZfTw==}