Ensure we only allow lowercase usernames

cmd/create-account/main.go

@@ -21,6 +21,7 @@ import (
 	"io"
 	"io/ioutil"
 	"os"
+	"regexp"
 	"strings"
 
 	"github.com/matrix-org/dendrite/setup/base"
@@ -61,6 +62,7 @@ var (
 	askPass            = flag.Bool("ask-pass", false, "Ask for the password to use")
 	isAdmin            = flag.Bool("admin", false, "Create an admin account")
 	resetPassword      = flag.Bool("reset-password", false, "Resets the password for the given username")
+	validUsernameRegex = regexp.MustCompile(`^[0-9a-z_\-=./]+$`)
 )
 
 func main() {
@@ -76,6 +78,11 @@ func main() {
 		os.Exit(1)
 	}
 
+	if !validUsernameRegex.MatchString(*username) {
+		logrus.Warn("Username can only contain characters a-z, 0-9, or '_-./='")
+		os.Exit(1)
+	}
+
 	pass := getPassword(password, pwdFile, pwdStdin, askPass, os.Stdin)
 
 	b := base.NewBaseDendrite(cfg, "create-account")