fix: validate usernames on registration

pkg/user/user.go

@@ -183,8 +183,8 @@ func GetFromAuth(a web.Auth) (*User, error) {
 type APIUserPassword struct {
 	// The unique, numeric id of this user.
 	ID int64 `json:"id"`
-	// The username of the username. Is always unique.
-	Username string `json:"username" valid:"length(3|250)" minLength:"3" maxLength:"250"`
+	// The user's username. Cannot contain anything that looks like an url or whitespaces.
+	Username string `json:"username" valid:"length(3|250),username" minLength:"3" maxLength:"250"`
 	// The user's password in clear text. Only used when registering the user.
 	Password string `json:"password" valid:"length(8|250)" minLength:"8" maxLength:"250"`
 	// The user's email address

pkg/user/username_valid.go

@@ -0,0 +1,36 @@
+// Vikunja is a to-do list application to facilitate your life.
+// Copyright 2018-present Vikunja and contributors. All rights reserved.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public Licensee as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public Licensee for more details.
+//
+// You should have received a copy of the GNU Affero General Public Licensee
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package user
+
+import "github.com/asaskevich/govalidator"
+
+func init() {
+	govalidator.TagMap["username"] = func(i string) bool {
+		// To avoid making this overly complicated, we only two things:
+		// 1. No Spaces
+		// 2. Should not look like an url
+		if govalidator.IsURL(i) {
+			return false
+		}
+
+		if govalidator.HasWhitespace(i) {
+			return false
+		}
+
+		return true
+	}
+}