Forbid special characters in object names

[yhabteab]

Describe the bug

Currently, Icinga 2 allows any characters in object names, which can lead to issues with certain characters that have special meanings in various contexts (e.g., backslashes, carriage returns, line feeds, newlines etc.). For example, to my limited knowledge, no one uses intentionally a newline char in object names, but since Icinga 2 allows it, he don't even notice it until some of the components (e.g., perf data writers) start to misbehave. Apart from that, Icinga Web 2 doesn't even allow such characters in object names, so if you try to open the object detail page of an object with a newline in its name, you'll be greeted with this.

So, I propose to forbid all special characters in object names, or at least the ones that are known to cause issues.

ref/IP/60981

Additional context

Add any other context about the problem here.

[slalomsk8er]

In general I detest such artificial restrictions as it hides problems in other systems and protects lazy programmers from having to validate inputs.

Maybe 2 sets are needed:

1. block very problematic chars like newlines and other control chars
2. for potentially problematic chars like backslashes
   I would warn about them on config check, maybe even in context of enabled writer features.

Is this about the DSL because as you wrote, Icinga Web 2 (director?) is already filtering chars manually imputed by users - how about the API and input sources?
How is he Icinga2 API Handling object names?

[yhabteab]

Is this about the DSL because as you wrote, Icinga Web 2 (director?) is already filtering chars manually imputed by users - how about the API and input sources?
How is he Icinga2 API Handling object names?

This has not necessarily to do with the DSL. If we're going to do this, then there won't be any way to bypass it. Currently, the API does nothing different than the DSL, you can create objects with any names/display_names, including special characters
and still mess things up. I don't know how the Icinga Director handles this, but if it does apply some filtering already on some inputs, then it should probably do it everywhere, including for imported configs. But I'm not that familiar with Icinga Director, so I can't say for sure.

Here is an example for display_name with new lines, you can also do the exact same for object names but I won't provide an example for that because I don't want to encourage users to copy and paste that into their configs :).

$ curl -ksSu root:icinga -H 'Accept: application/json' \
 -X PUT 'https://localhost:5665/v1/objects/hosts/DONOTDOTHIS' \
 -d '{ "attrs": { "display_name": "DO\nNot\nDo\nTHIS", "check_command": "dummy"}, "pretty": true }'