16 ms·

I'm a little confused about the issue description, because "mov" is not a MIME type. Examples of MIME types: "text/plain", "text/html", "image/png" "applicatio

I'm a little confused about the issue description, because "mov" is not a MIME type. Examples of MIME types: "text/plain", "text/html", "image/png" "application/pdf", "video/quicktime", ... If I was prevented from using the username "wcoenentext/html", then I wouldn't really be bothered by that. (Although I might question the design decisions that would necessitate such a restriction.)

a-dub 5y ago
it seems pretty obvious that they mean any file extension registered to a known MIME type.
- AlfeG 5y ago
  I guess author of ticket were referring to internal type name mime_type
- gpvos 5y ago
  It's easy, basic, and very important for clarity to use the correct terminology in this case. A MIME type is really something different.
  - p49k 5y ago
    It’s unrealistic to expect everyone to be able to know and use terminology perfectly. The description itself was well-written and that’s what’s important in terms of finding/fixing the issue.
    - rjmunro 5y ago
      The bug reporter merely copies the incorrect error that gitlab gave him; The issue here is that someone working in login / security of gitlab doesn't know what a mime type is. That is extremely worrying - it's not a part of the code where you can afford to be sloppy. It's a very odd error. Apparently .nro is a file extension used by the Nintendo Switch video game console; .o is obviously the output of compilers, so I'm not sure why my username wasn't rejected. Maybe it would be if I tried to register now.
    - DonHopkins 5y ago
      It's foolish to use a standard well defined very precise but incorrect term of art like like "MIME Type" that is actively misleading to a technical audience of github users who are more likely than most people to know the standard official definition, and which is LESS commonly known than a correct widely understood vernacular term like "file name extension", if your goal is to be understood by everyone. I'd rather a technically oriented site like github be "unrealistic" and correct and instructive, than foolish and wrong and misleading. Are you really saying it's better to use the wrong term because github users might not understand the more widely known correct term? Just how does leading the user on a wild goose chase looking up the definition of "MIME Type," causing them to waste their time and misunderstand the error message, when it's really a file name extension (a term which more people understand anyway), help the user achieve their goals? The bottom line is that github disallowing "MIME Types" or "file name extensions" in user names, just like a bank disallowing "select" and "drop" and "from" and "null" and "delete" and "bobby" and "tables" in passwords, is a symptom of a much larger more terrible problem, and whoever wrote that stupid error message instead of fixing the underlying bug that caused it has much worse problems than poor English language writing skills.
      - p49k 5y ago
        Sorry, I thought you were referring to the bug reporter rather than the author of the error message itself, in the latter case I agree.
      - carl_dr 5y ago
        Muphry's law strikes again! The bug affected Gitlab, not GitHub.
  - a-dub 5y ago
    "ERROR: The Gitlab server has rejected the proposed username, as it ends in the same suffix as a file extension that is registered to a MIME type in the Ruby runtime under which the server runs. This list is quite long, and possibly difficult to retrieve, so we will not list it here, but you can find a list of extensions commonly used if you Google for MIME. Alternatively, if this makes no sense at all, ask a local alpha geek and they should be able to help. We understand this is weird, but the reasons for doing so are currently embargoed as they potentially have wide ranging security or stability consequences for a large number of installs. If you wouldn't mind, please do us a small one and keep quiet while we have a chance to prepare and distribute a patch without forcing anyone to forego any nights of sleep 18 months into a global pandemic complete with associated societal fracturing and potential economic collapse. Thank you for your cooperation on this easy, basic and very important matter." fixed it!
- hnlmorg 5y ago
  In fairness, it is Gitlabs wording the issue reporter is using. Check the error message.
  - Grollicus 5y ago
    Gitlab recently exchanged the "WIP" prefix for merge requests (Work in Progress = started to do something but didn't complete it yet) for "Draft", which has connotations of throwing the draft/sketch away to build the final product. Which is definitively not what is meant there. But I think it shows that Gitlab is not a company I'd go to if I wanted linguistic precision.
    - gls2ro 5y ago
      I am not a native English speaker (and I don't work at Gitlab) but I am curious and interested in using proper terms, as I think as developer that naming is a very important skill. So, I find strange this meaning that you give for a "draft" = that it is something that has connotation of throwing away when building the final product. I think you are confusing a "draft" with a "sketch" and they are not the same. I googled the term "draft" and here is what I found: > "a version of something (such as a document) that you make before you make the final version" [1] > "A preliminary version of a piece of writing." [2] While "sketch" means: > "a rough drawing representing the chief features of an object or scene and often made as a preliminary study" [3] > "A rough or unfinished version of any creative work." [3] > "A rough or unfinished drawing or painting, often made to assist in making a more finished picture." [4] In the case of sketch I see some keywords like "preliminary study" or "assist" or "unfinished version" that indicates that the sketch will not be the final product. So while it is true that a Draft could be thrown away if someone has new/better/difference ideas while working on it, it does not seem to imply that a Draft should be thrown when building the final product. As far as I understand it is more that a draft will evolve into a final product or might be abandoned. [1] https://www.merriam-webster.com/dictionary/draft https://www.merriam-webster.com/dictionary/draft [2] https://www.lexico.com/definition/draft https://www.lexico.com/definition/draft [3] https://www.lexico.com/definition/sketch https://www.lexico.com/definition/sketch [4] https://www.merriam-webster.com/dictionary/sketch https://www.merriam-webster.com/dictionary/sketch
- DonHopkins 5y ago
  Since file extensions can be any three or fewer (or even more) valid characters, then no string ending with zero to three characters, in other words, no user names are valid.
- jfrunyon 5y ago
  No file extension <-> MIME type "registry" exists. File extensions exist completely outside of MIME. Many file extensions do not correspond to a registered MIME type, or in many cases even a de-facto one (other than application/octet-stream or text/plain). It seems pretty obvious - based on the failed username in question, and to someone with fairly deep technical knowledge - that they mean anything they consider a file extension. Which is not an excuse for this marvel of awful UI slapped on top of a poorly-thought-out workaround (for some unknown vuln (that's been patched for over 2 months and is still private? quite strange for an "open" company eh?).
  - yuliyp 5y ago
    Officially no such registry exists. In practice, Apache does have such a registry by default: https://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types https://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf... and other systems do use that mapping or a similar one.
    - jfrunyon 5y ago
      > File extensions exist completely outside of MIME. Yes. I am well aware that certain software, such as Windows, MimeMagic, or Apache, do include their own lists. That is not a "registry" and in fact you will likely find that every such list is either identical to, a fork of, or incompatible with every other such list.
      - yuliyp 5y ago
        I agree with you, I think? Whether you call such a list a registry or not is fairly trivial, I think. Their web server uses such a mapping, and for some reason usernames with suffixes on that list confused something. Call it a registry, or a mapping, or a list, the meaning of the statement is the same, and I don't think it prevents most people from understanding what's going on.
        jfrunyon 5y ago
- hibbelig 5y ago
  > it seems pretty obvious that they mean any file extension registered to a known MIME type. I guess I'm dense, but I actually thought it's about users such as Mr. Joe R Text/Plain. When I read about "mov" in the actual issue, then it became clear.
zodiakzz 5y ago
The word they're looking for is "file extension name".
- deleted 5y ago
  [deleted]
  - deleted 5y ago
    [deleted]
- iamtedd 5y ago
  Who are you, Kath Day-Night?
  - iamtedd 5y ago
    I wanted to find an example from Kath & Kim, but couldn't find any on Youtube that wasn't just the "Look at moi" set-up to the actual joke. I'm sorry.
- pastage 5y ago
  This is interesting because compounds are mostly written together in other languages. Never thought about it but file extension name really is a word. Someone replied saying this is three words, but it is not is it? It's an open compound word or maybe a "set phrase", I wanted to call it an idiomatic expression but that was clearly wrong.
  - hunter2_ 5y ago
    The Wikipedia articles for "Set phrase" [0] and "Compound (linguistics)" [1] actually don't offer much of a distinction, so it's hard to say which of those is correct. Regardless, a compound with spaces ("open," as you said) is multiple words, not one word. [0] https://en.m.wikipedia.org/wiki/Set_phrase https://en.m.wikipedia.org/wiki/Set_phrase [1] https://en.m.wikipedia.org/wiki/Compound_(linguistics) https://en.m.wikipedia.org/wiki/Compound_(linguistics)
- qwerty456127 5y ago
scblzn 5y ago
Hello, I’m the author of the issue on Gitlab (small world, isn’t it ?) Yes the message is confusing and I agree that .mov isn’t a MIME type but I was merely reporting the error message shown ( plus, they added .mov in their list of file types and had aliased it to .mp4 format, please see: https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/initializers/mime_types.rb#L14 https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/in... )
- codetrotter 5y ago
  > they added .mov in their list of file types and had aliased it to .mp4 format That’s weird. Why’d they do that. They should make a separate entry for mov and associate it with video/quicktime Guess it might be something related to https://stackoverflow.com/a/44785870 https://stackoverflow.com/a/44785870 but like they point out, mov is a container format that can contain one of many different codecs used. And isn’t mp4 just a container too? Referring to mov files as video/mp4 seems straight up incorrect to me
  - robertony 5y ago
    Modern mov files are just mp4 containers.
    - codetrotter 5y ago
      I don’t think that’s quite right is it? As I understand, mp4 is based on mov. But they still very much are distinct container formats, and an implementation of the mp4 standard would likely not be able to correctly read mov files as is, would it?
      - banana_giraffe 5y ago
        They're very close. The ISO base media file format was directly based off of QuickTime container format. If you look at a .mov file and a .mp4 file in a ISO bmff viewer, you'll generally see the only difference is the ftyp box is different ("qt " for .mov, "isom" for .mp4). Indeed, if you ask ffmpeg to make a .mov file and .mp4 file of the same content, literally the only difference is the contents of the "ftyp" box, every other byte is identical.
eyelidlessness 5y ago
Damn and I was about to start registering usernames like for json/bourne but I guess that’s overly specific.
- waspight 5y ago
  That will be the name of my next child.
  - pulse7 5y ago
    Please don't do that... Elon Musk's son is named "X Æ A-12", don't follow his steps...
    - bierjunge 5y ago
      Yes, don't do that, name the kid "null" and see the world burning.
      - yellow_lead 5y ago
        See your kid have trouble getting any official documentation :/
        tomalpha 5y ago
        Or booking flights, filing taxes, signing up for shifts at work: https://www.bbc.com/future/article/20160325-the-names-that-break-computer-systems https://www.bbc.com/future/article/20160325-the-names-that-b...
      - rPlayer6554 5y ago
        Poor Bobby tables.... https://xkcd.com/327/ https://xkcd.com/327/
      - belter 5y ago
        A common name... https://www.facebook.com/public/James-Null https://www.facebook.com/public/James-Null as well as Abcde https://www.facebook.com/public/Abcde https://www.facebook.com/public/Abcde
sytse 5y ago
This is a very confusing issue description which is caused by a confusing error message. This comment https://news.ycombinator.com/item?id=28540665 https://news.ycombinator.com/item?id=28540665 does a great job explaining the context. TLDR; you can't have a username end in .filetype because it might cause the user profile page to not load. The limitation is _not_ related to injection attack prevention, that would be concerning (bobby tables xkcd https://xkcd.com/327/ https://xkcd.com/327/ ).
- duskwuff 5y ago
  And it was exacerbated by another bug which was causing the absence of a period to be ignored, so any username ending in a recognized filetype was blocked (e.g. "AsiMOV" in the example, or "MaasTIFF" in the comments). I initially suspected that a regex was involved and someone forgot to escape the period, but it looks like that wasn't even the case -- the erroneous code was literally checking if the username ended in any recognized extension. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/65954/diffs https://gitlab.com/gitlab-org/gitlab/-/merge_requests/65954/...
pwdisswordfish8 5y ago
> I'm a little confused about the issue description Not helped by the fact that even with explicit cajoling* to give steps to reproduce, the reporter wrote: > Steps to reproduce >Try to login/create an user in Gitlab (on-premises/Gitlab.com) where the username ends with a MIME type format Goddamit, those are not steps to reproduce! Has the current era of "social coding" and its terrible software development practices completely turned people's brains to mush? (In fact, such cajoling shouldn't even be required. If you don't know you need to provide STR without someone going to the lengths of coddling you by going out of their way to create a template, you don't have any business using a bug tracker.)
- svrtknst 5y ago
  ok boomer
  - pwdisswordfish8 5y ago
    What, did that make you mad? Why're you mad?
  - IIsi50MHz 5y ago
    The provided step-to-reproduce (not steps, since there's only one) seems to be regarded by the reporter as an automic operation (indivisble; a single step). The other person is, I think, trying to express that it can potentially be done more than one way, so additional steps are required. From a QA perspective, I prefer not to guess what the reporter might have intended. It's much better to have tons of detail, but I can sympathise with being the user and _thinking_ you have been totally clear and am know I've sometimes done this myself. (( Unrelatedly, "ok boomer"? Since that seems such a non sequitur, I'll take in another unrelated direction and raise you an "ok athena" and "waddaya hear, starkuck?". ))
    - pwdisswordfish8 5y ago
      You have been trolled. The entire point of saying "ok boomer" here is to, as economically as possible, be dismissive while getting the other side to spend disproportionate energy defending the the thing being dismissed. > From a QA perspective, I prefer not to guess what the reporter might have intended There's not really any other perspective. That thing which you say you "prefer" is much more than a preference. It is the only reason why the bug tracker is configured to even ask for STR. If you have a "no solicitors" sign on your front door and a solicitor comes knocking anyway, or you have your door locked and a burglar climbs through a broken window and and takes all your stuff, you wouldn't respond by saying, "from my perspective, it's really disruptive and time-consuming to deal with solicitors who ignore the sign" or, "try to understand that from my perspective, it's really inconvenient when you take my things, because I have to work and spend money to replace them when I could have used that time and money doing something else." To do so tacitly legitimizes an illegitimate position held by the other. Please look up "DARVO" to understand why explaining yourself like this is a bad idea.

a-dub 5y ago

it seems pretty obvious that they mean any file extension registered to a known MIME type.

AlfeG 5y ago
I guess author of ticket were referring to internal type name mime_type
gpvos 5y ago
It's easy, basic, and very important for clarity to use the correct terminology in this case. A MIME type is really something different.
- p49k 5y ago
  It’s unrealistic to expect everyone to be able to know and use terminology perfectly. The description itself was well-written and that’s what’s important in terms of finding/fixing the issue.
  - rjmunro 5y ago
    The bug reporter merely copies the incorrect error that gitlab gave him; The issue here is that someone working in login / security of gitlab doesn't know what a mime type is. That is extremely worrying - it's not a part of the code where you can afford to be sloppy. It's a very odd error. Apparently .nro is a file extension used by the Nintendo Switch video game console; .o is obviously the output of compilers, so I'm not sure why my username wasn't rejected. Maybe it would be if I tried to register now.
  - DonHopkins 5y ago
    It's foolish to use a standard well defined very precise but incorrect term of art like like "MIME Type" that is actively misleading to a technical audience of github users who are more likely than most people to know the standard official definition, and which is LESS commonly known than a correct widely understood vernacular term like "file name extension", if your goal is to be understood by everyone. I'd rather a technically oriented site like github be "unrealistic" and correct and instructive, than foolish and wrong and misleading. Are you really saying it's better to use the wrong term because github users might not understand the more widely known correct term? Just how does leading the user on a wild goose chase looking up the definition of "MIME Type," causing them to waste their time and misunderstand the error message, when it's really a file name extension (a term which more people understand anyway), help the user achieve their goals? The bottom line is that github disallowing "MIME Types" or "file name extensions" in user names, just like a bank disallowing "select" and "drop" and "from" and "null" and "delete" and "bobby" and "tables" in passwords, is a symptom of a much larger more terrible problem, and whoever wrote that stupid error message instead of fixing the underlying bug that caused it has much worse problems than poor English language writing skills.
    - p49k 5y ago
      Sorry, I thought you were referring to the bug reporter rather than the author of the error message itself, in the latter case I agree.
    - carl_dr 5y ago
      Muphry's law strikes again! The bug affected Gitlab, not GitHub.
- a-dub 5y ago
  "ERROR: The Gitlab server has rejected the proposed username, as it ends in the same suffix as a file extension that is registered to a MIME type in the Ruby runtime under which the server runs. This list is quite long, and possibly difficult to retrieve, so we will not list it here, but you can find a list of extensions commonly used if you Google for MIME. Alternatively, if this makes no sense at all, ask a local alpha geek and they should be able to help. We understand this is weird, but the reasons for doing so are currently embargoed as they potentially have wide ranging security or stability consequences for a large number of installs. If you wouldn't mind, please do us a small one and keep quiet while we have a chance to prepare and distribute a patch without forcing anyone to forego any nights of sleep 18 months into a global pandemic complete with associated societal fracturing and potential economic collapse. Thank you for your cooperation on this easy, basic and very important matter." fixed it!
hnlmorg 5y ago
In fairness, it is Gitlabs wording the issue reporter is using. Check the error message.
- Grollicus 5y ago
  Gitlab recently exchanged the "WIP" prefix for merge requests (Work in Progress = started to do something but didn't complete it yet) for "Draft", which has connotations of throwing the draft/sketch away to build the final product. Which is definitively not what is meant there. But I think it shows that Gitlab is not a company I'd go to if I wanted linguistic precision.
  - gls2ro 5y ago
    I am not a native English speaker (and I don't work at Gitlab) but I am curious and interested in using proper terms, as I think as developer that naming is a very important skill. So, I find strange this meaning that you give for a "draft" = that it is something that has connotation of throwing away when building the final product. I think you are confusing a "draft" with a "sketch" and they are not the same. I googled the term "draft" and here is what I found: > "a version of something (such as a document) that you make before you make the final version" [1] > "A preliminary version of a piece of writing." [2] While "sketch" means: > "a rough drawing representing the chief features of an object or scene and often made as a preliminary study" [3] > "A rough or unfinished version of any creative work." [3] > "A rough or unfinished drawing or painting, often made to assist in making a more finished picture." [4] In the case of sketch I see some keywords like "preliminary study" or "assist" or "unfinished version" that indicates that the sketch will not be the final product. So while it is true that a Draft could be thrown away if someone has new/better/difference ideas while working on it, it does not seem to imply that a Draft should be thrown when building the final product. As far as I understand it is more that a draft will evolve into a final product or might be abandoned. [1] https://www.merriam-webster.com/dictionary/draft https://www.merriam-webster.com/dictionary/draft [2] https://www.lexico.com/definition/draft https://www.lexico.com/definition/draft [3] https://www.lexico.com/definition/sketch https://www.lexico.com/definition/sketch [4] https://www.merriam-webster.com/dictionary/sketch https://www.merriam-webster.com/dictionary/sketch
DonHopkins 5y ago
Since file extensions can be any three or fewer (or even more) valid characters, then no string ending with zero to three characters, in other words, no user names are valid.
jfrunyon 5y ago
No file extension <-> MIME type "registry" exists. File extensions exist completely outside of MIME. Many file extensions do not correspond to a registered MIME type, or in many cases even a de-facto one (other than application/octet-stream or text/plain). It seems pretty obvious - based on the failed username in question, and to someone with fairly deep technical knowledge - that they mean anything they consider a file extension. Which is not an excuse for this marvel of awful UI slapped on top of a poorly-thought-out workaround (for some unknown vuln (that's been patched for over 2 months and is still private? quite strange for an "open" company eh?).
- yuliyp 5y ago
  Officially no such registry exists. In practice, Apache does have such a registry by default: https://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types https://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf... and other systems do use that mapping or a similar one.
  - jfrunyon 5y ago
    > File extensions exist completely outside of MIME. Yes. I am well aware that certain software, such as Windows, MimeMagic, or Apache, do include their own lists. That is not a "registry" and in fact you will likely find that every such list is either identical to, a fork of, or incompatible with every other such list.
    - yuliyp 5y ago
      I agree with you, I think? Whether you call such a list a registry or not is fairly trivial, I think. Their web server uses such a mapping, and for some reason usernames with suffixes on that list confused something. Call it a registry, or a mapping, or a list, the meaning of the statement is the same, and I don't think it prevents most people from understanding what's going on.
      - jfrunyon 5y ago
hibbelig 5y ago
> it seems pretty obvious that they mean any file extension registered to a known MIME type. I guess I'm dense, but I actually thought it's about users such as Mr. Joe R Text/Plain. When I read about "mov" in the actual issue, then it became clear.

zodiakzz 5y ago

The word they're looking for is "file extension name".

deleted 5y ago
[deleted]
- deleted 5y ago
  [deleted]
iamtedd 5y ago
Who are you, Kath Day-Night?
- iamtedd 5y ago
  I wanted to find an example from Kath & Kim, but couldn't find any on Youtube that wasn't just the "Look at moi" set-up to the actual joke. I'm sorry.
pastage 5y ago
This is interesting because compounds are mostly written together in other languages. Never thought about it but file extension name really is a word. Someone replied saying this is three words, but it is not is it? It's an open compound word or maybe a "set phrase", I wanted to call it an idiomatic expression but that was clearly wrong.
- hunter2_ 5y ago
  The Wikipedia articles for "Set phrase" [0] and "Compound (linguistics)" [1] actually don't offer much of a distinction, so it's hard to say which of those is correct. Regardless, a compound with spaces ("open," as you said) is multiple words, not one word. [0] https://en.m.wikipedia.org/wiki/Set_phrase https://en.m.wikipedia.org/wiki/Set_phrase [1] https://en.m.wikipedia.org/wiki/Compound_(linguistics) https://en.m.wikipedia.org/wiki/Compound_(linguistics)
qwerty456127 5y ago

scblzn 5y ago

Hello, I’m the author of the issue on Gitlab (small world, isn’t it ?) Yes the message is confusing and I agree that .mov isn’t a MIME type but I was merely reporting the error message shown ( plus, they added .mov in their list of file types and had aliased it to .mp4 format, please see: https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/initializers/mime_types.rb#L14 https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/in... )

codetrotter 5y ago
> they added .mov in their list of file types and had aliased it to .mp4 format That’s weird. Why’d they do that. They should make a separate entry for mov and associate it with video/quicktime Guess it might be something related to https://stackoverflow.com/a/44785870 https://stackoverflow.com/a/44785870 but like they point out, mov is a container format that can contain one of many different codecs used. And isn’t mp4 just a container too? Referring to mov files as video/mp4 seems straight up incorrect to me
- robertony 5y ago
  Modern mov files are just mp4 containers.
  - codetrotter 5y ago
    I don’t think that’s quite right is it? As I understand, mp4 is based on mov. But they still very much are distinct container formats, and an implementation of the mp4 standard would likely not be able to correctly read mov files as is, would it?
    - banana_giraffe 5y ago
      They're very close. The ISO base media file format was directly based off of QuickTime container format. If you look at a .mov file and a .mp4 file in a ISO bmff viewer, you'll generally see the only difference is the ftyp box is different ("qt " for .mov, "isom" for .mp4). Indeed, if you ask ffmpeg to make a .mov file and .mp4 file of the same content, literally the only difference is the contents of the "ftyp" box, every other byte is identical.

eyelidlessness 5y ago

Damn and I was about to start registering usernames like for json/bourne but I guess that’s overly specific.

waspight 5y ago
That will be the name of my next child.
- pulse7 5y ago
  Please don't do that... Elon Musk's son is named "X Æ A-12", don't follow his steps...
  - bierjunge 5y ago
    Yes, don't do that, name the kid "null" and see the world burning.
    - yellow_lead 5y ago
      See your kid have trouble getting any official documentation :/
      - tomalpha 5y ago
        Or booking flights, filing taxes, signing up for shifts at work: https://www.bbc.com/future/article/20160325-the-names-that-break-computer-systems https://www.bbc.com/future/article/20160325-the-names-that-b...
    - rPlayer6554 5y ago
      Poor Bobby tables.... https://xkcd.com/327/ https://xkcd.com/327/
    - belter 5y ago
      A common name... https://www.facebook.com/public/James-Null https://www.facebook.com/public/James-Null as well as Abcde https://www.facebook.com/public/Abcde https://www.facebook.com/public/Abcde

sytse 5y ago

This is a very confusing issue description which is caused by a confusing error message. This comment https://news.ycombinator.com/item?id=28540665 https://news.ycombinator.com/item?id=28540665 does a great job explaining the context. TLDR; you can't have a username end in .filetype because it might cause the user profile page to not load. The limitation is _not_ related to injection attack prevention, that would be concerning (bobby tables xkcd https://xkcd.com/327/ https://xkcd.com/327/ ).

duskwuff 5y ago
And it was exacerbated by another bug which was causing the absence of a period to be ignored, so any username ending in a recognized filetype was blocked (e.g. "AsiMOV" in the example, or "MaasTIFF" in the comments). I initially suspected that a regex was involved and someone forgot to escape the period, but it looks like that wasn't even the case -- the erroneous code was literally checking if the username ended in any recognized extension. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/65954/diffs https://gitlab.com/gitlab-org/gitlab/-/merge_requests/65954/...

pwdisswordfish8 5y ago

> I'm a little confused about the issue description Not helped by the fact that even with explicit cajoling* to give steps to reproduce, the reporter wrote: > Steps to reproduce >Try to login/create an user in Gitlab (on-premises/Gitlab.com) where the username ends with a MIME type format Goddamit, those are not steps to reproduce! Has the current era of "social coding" and its terrible software development practices completely turned people's brains to mush? (In fact, such cajoling shouldn't even be required. If you don't know you need to provide STR without someone going to the lengths of coddling you by going out of their way to create a template, you don't have any business using a bug tracker.)

svrtknst 5y ago
ok boomer
- pwdisswordfish8 5y ago
  What, did that make you mad? Why're you mad?
- IIsi50MHz 5y ago
  The provided step-to-reproduce (not steps, since there's only one) seems to be regarded by the reporter as an automic operation (indivisble; a single step). The other person is, I think, trying to express that it can potentially be done more than one way, so additional steps are required. From a QA perspective, I prefer not to guess what the reporter might have intended. It's much better to have tons of detail, but I can sympathise with being the user and _thinking_ you have been totally clear and am know I've sometimes done this myself. (( Unrelatedly, "ok boomer"? Since that seems such a non sequitur, I'll take in another unrelated direction and raise you an "ok athena" and "waddaya hear, starkuck?". ))
  - pwdisswordfish8 5y ago
    You have been trolled. The entire point of saying "ok boomer" here is to, as economically as possible, be dismissive while getting the other side to spend disproportionate energy defending the the thing being dismissed. > From a QA perspective, I prefer not to guess what the reporter might have intended There's not really any other perspective. That thing which you say you "prefer" is much more than a preference. It is the only reason why the bug tracker is configured to even ask for STR. If you have a "no solicitors" sign on your front door and a solicitor comes knocking anyway, or you have your door locked and a burglar climbs through a broken window and and takes all your stuff, you wouldn't respond by saying, "from my perspective, it's really disruptive and time-consuming to deal with solicitors who ignore the sign" or, "try to understand that from my perspective, it's really inconvenient when you take my things, because I have to work and spend money to replace them when I could have used that time and money doing something else." To do so tacitly legitimizes an illegitimate position held by the other. Please look up "DARVO" to understand why explaining yourself like this is a bad idea.