secure/precis: add ability to restrict profiles
Fixes golang/go#24885
Change-Id: I4d5e6c9279af9c3183aa71b4f4562209445af165
Reviewed-on: https://go-review.googlesource.com/113816
Reviewed-by: Marcel van Lohuizen <mpvl@golang.org>
diff --git a/secure/precis/enforce10.0.0_test.go b/secure/precis/enforce10.0.0_test.go
index f224936..34da150 100644
--- a/secure/precis/enforce10.0.0_test.go
+++ b/secure/precis/enforce10.0.0_test.go
@@ -7,6 +7,9 @@
package precis
import (
+ "strings"
+
+ "golang.org/x/text/runes"
"golang.org/x/text/secure/bidirule"
)
@@ -241,4 +244,10 @@
{"\u212B", "\u00c5", nil}, // Angstrom sign, NFC -> U+00E5
{"ẛ", "", errDisallowedRune}, // LATIN SMALL LETTER LONG S WITH DOT ABOVE
}},
+ {"UsernameCaseMappedRestricted", NewRestrictedProfile(UsernameCaseMapped, runes.Predicate(func(r rune) bool {
+ return strings.ContainsRune(`@`, r)
+ })), []testCase{
+ {"juliet@example.com", "", errDisallowedRune},
+ {"\u0049", "\u0069", nil},
+ }},
}
diff --git a/secure/precis/enforce9.0.0_test.go b/secure/precis/enforce9.0.0_test.go
index 298c8a9..ed5759c 100644
--- a/secure/precis/enforce9.0.0_test.go
+++ b/secure/precis/enforce9.0.0_test.go
@@ -241,4 +241,10 @@
{"\u212B", "\u00c5", nil}, // Angstrom sign, NFC -> U+00E5
{"ẛ", "", errDisallowedRune}, // LATIN SMALL LETTER LONG S WITH DOT ABOVE
}},
+ {"UsernameCaseMappedRestricted", NewRestrictedProfile(UsernameCaseMapped, runes.Predicate(func(r rune) bool {
+ return strings.ContainsRune(`@`, r)
+ })), []testCase{
+ {"juliet@example.com", "", errDisallowedRune},
+ {"\u0049", "\u0069", nil},
+ }},
}
diff --git a/secure/precis/profile.go b/secure/precis/profile.go
index 0419159..35bd6f0 100644
--- a/secure/precis/profile.go
+++ b/secure/precis/profile.go
@@ -52,6 +52,16 @@
}
}
+// NewRestrictedProfile creates a new PRECIS profile based on an existing
+// profile.
+// If the parent profile already had the Disallow option set, the new rule
+// overrides the parents rule.
+func NewRestrictedProfile(parent *Profile, disallow runes.Set) *Profile {
+ p := *parent
+ Disallow(disallow)(&p.options)
+ return &p
+}
+
// NewTransformer creates a new transform.Transformer that performs the PRECIS
// preparation and enforcement steps on the given UTF-8 encoded bytes.
func (p *Profile) NewTransformer() *Transformer {
