Add tenantID validation to regex validator (cortexproject#6836)

SungJin1212 · web-flow · commit 7f107fe9d569 · 2025-06-29T11:30:14.000-07:00
Signed-off-by: SungJin1212 &lt;tjdwls1201@gmail.com&gt;
diff --git a/pkg/querier/tenantfederation/regex_resolver.go b/pkg/querier/tenantfederation/regex_resolver.go
@@ -184,6 +184,14 @@ func (r *RegexValidator) TenantID(ctx context.Context) (string, error) {
 		return "", errInvalidRegex
 	}
 
+	if err := tenant.CheckTenantIDLength(id); err != nil {
+		return "", err
+	}
+
+	if err := tenant.CheckTenantIDIsSupported(id); err != nil {
+		return "", err
+	}
+
 	return id, nil
 }
 
diff --git a/pkg/querier/tenantfederation/regex_resolver_test.go b/pkg/querier/tenantfederation/regex_resolver_test.go
@@ -2,6 +2,8 @@ package tenantfederation
 
 import (
 	"context"
+	"errors"
+	"strings"
 	"testing"
 	"time"
 
@@ -120,6 +122,31 @@ func Test_RegexValidator(t *testing.T) {
 			orgID:       "[a-z",
 			expectedErr: errInvalidRegex,
 		},
+		{
+			description: "tenant ID is too long",
+			orgID:       strings.Repeat("a", 151),
+			expectedErr: errors.New("tenant ID is too long: max 150 characters"),
+		},
+		{
+			description: ".",
+			orgID:       ".",
+			expectedErr: errors.New("tenant ID is '.' or '..'"),
+		},
+		{
+			description: "..",
+			orgID:       "..",
+			expectedErr: errors.New("tenant ID is '.' or '..'"),
+		},
+		{
+			description: "__markers__",
+			orgID:       "__markers__",
+			expectedErr: errors.New("tenant ID '__markers__' is not allowed"),
+		},
+		{
+			description: "user-index.json.gz",
+			orgID:       "user-index.json.gz",
+			expectedErr: errors.New("tenant ID 'user-index.json.gz' is not allowed"),
+		},
 	}
 
 	for _, tc := range tests {
diff --git a/pkg/tenant/tenant.go b/pkg/tenant/tenant.go
@@ -54,7 +54,7 @@ func NormalizeTenantIDs(tenantIDs []string) []string {
 	return tenantIDs[0:posOut]
 }
 
-// ValidTenantID
+// ValidTenantID validate tenantID
 func ValidTenantID(s string) error {
 	// check if it contains invalid runes
 	for pos, r := range s {
@@ -66,10 +66,26 @@ func ValidTenantID(s string) error {
 		}
 	}
 
+	if err := CheckTenantIDLength(s); err != nil {
+		return err
+	}
+
+	if err := CheckTenantIDIsSupported(s); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func CheckTenantIDLength(s string) error {
 	if len(s) > 150 {
 		return errTenantIDTooLong
 	}
 
+	return nil
+}
+
+func CheckTenantIDIsSupported(s string) error {
 	// check tenantID is "__markers__"
 	if s == GlobalMarkersDir {
 		return errTenantIDMarkers

Original file line number	Diff line number	Diff line change
`@@ -184,6 +184,14 @@ func (r *RegexValidator) TenantID(ctx context.Context) (string, error) {`
`184`	`184`	`return "", errInvalidRegex`
`185`	`185`	`}`
`186`	`186`
	`187`	`+ if err := tenant.CheckTenantIDLength(id); err != nil {`
	`188`	`+ return "", err`
	`189`	`+ }`
	`190`	`+`
	`191`	`+ if err := tenant.CheckTenantIDIsSupported(id); err != nil {`
	`192`	`+ return "", err`
	`193`	`+ }`
	`194`	`+`
`187`	`195`	`return id, nil`
`188`	`196`	`}`
`189`	`197`