player: enforce username whitelist

player.go

@@ -6,9 +6,15 @@ import (
 	"net"
 	"os"
 	"time"
+	"fmt"
+	"regexp"
 	//"errors"
 )
 
+var (
+	nameWhitelist = regexp.MustCompile(".*[^a-zA-Z0-9_].*") // replace all characters if any 'evil' one is present
+)
+
 type Context interface {
 	Register(*Player)
 	Unregister(string)
@@ -37,7 +43,6 @@ func NewPlayer(conn net.Conn) (p *Player) {
 	var err error
 	p = &Player{
 		conn:       conn,
-		connClosed: make(chan struct{}, 1),
 		tnState:    NewTelnetState(),
 		inputEvent: make(chan []byte, 50),
 		inputKill:  make(chan struct{}),
@@ -47,6 +52,14 @@ func NewPlayer(conn net.Conn) (p *Player) {
 	if err != nil {
 		log.Println(err)
 	}
+	if len(nameWhitelist.ReplaceAllString(p.name, "")) == 0 {
+		p.inputKill <- struct{}{}
+		close(p.inputKill)
+		close(p.inputEvent)
+		conn.Write([]byte(fmt.Sprintf("Invalid username >%s<\n", p.name)))
+		conn.Close()
+		return nil
+	}
 
 	if pOld, ok := gs.players[p.name]; ok {
 		// reconnect with replace
@@ -60,8 +73,9 @@ func NewPlayer(conn net.Conn) (p *Player) {
 			pNew.inputKill <- struct{}{}
 			close(pNew.inputKill)
 			close(pNew.inputEvent)
-			conn.Write([]byte("Username already taken\n"))
+			conn.Write([]byte(fmt.Sprintf("Username %s already taken\n", pNew.name)))
 			conn.Close()
+			log.Printf("%s tried to connect twice", p.name)
 			return nil
 		}
 
@@ -71,7 +85,6 @@ func NewPlayer(conn net.Conn) (p *Player) {
 
 		// clean up new player input, was only needed to query username
 		pNew.inputKill <- struct{}{}
-		close(pNew.connClosed)
 		close(pNew.inputKill)
 		close(pNew.inputEvent)
 
@@ -81,13 +94,16 @@ func NewPlayer(conn net.Conn) (p *Player) {
 		p.conn = pNew.conn
 		p.scr.Chown(conn)
 		go p.inputLoop()
+		log.Printf("%s reconnected\n", p.name)
 	} else {
 		p.windowSizeLoopKill = make(chan struct{})
+		p.connClosed = make(chan struct{}, 1)
 		// TODO new players need to be sent to the meta lobby context
 		p.context = glgl
 		p.scr = tg.NewScreenEmpty(conn, tg.ColorDefault, tg.ColorDefault)
 		go p.windowSizeLoop()
 		gs.players[p.name] = p
+		log.Printf("%s connected\n", p.name)
 	}
 	err = p.scr.Redraw()
 	if err != nil {