fix: disallow null bytes in name during register (#15951)

tests/unit/accounts/test_forms.py

@@ -765,6 +765,22 @@ def test_name_too_long(self, pyramid_config):
             == "The name is too long. Choose a name with 100 characters or less."
         )
 
+    def test_name_contains_null_bytes(self, pyramid_config):
+        form = forms.RegistrationForm(
+            request=pretend.stub(),
+            formdata=MultiDict({"full_name": "hello\0world"}),
+            user_service=pretend.stub(
+                find_userid=pretend.call_recorder(lambda _: None)
+            ),
+            captcha_service=pretend.stub(
+                enabled=False,
+                verify_response=pretend.call_recorder(lambda _: None),
+            ),
+            breach_service=pretend.stub(check_password=lambda pw, tags=None: True),
+        )
+        assert not form.validate()
+        assert form.full_name.errors.pop() == "Null bytes are not allowed."
+
 
 class TestRequestPasswordResetForm:
     @pytest.mark.parametrize(

warehouse/accounts/forms.py

@@ -71,7 +71,7 @@ def __init__(self, message=None):
         self.message = message
 
     def __call__(self, form, field):
-        if "\x00" in field.data:
+        if field.data and "\x00" in field.data:
             raise wtforms.validators.StopValidation(self.message)
 
 
@@ -349,7 +349,8 @@ class RegistrationForm(  # type: ignore[misc]
                     "The name is too long. "
                     "Choose a name with 100 characters or less."
                 ),
-            )
+            ),
+            PreventNullBytesValidator(),
         ]
     )
     g_recaptcha_response = wtforms.StringField()

warehouse/locale/messages.pot

@@ -94,23 +94,23 @@ msgstr ""
 msgid "The name is too long. Choose a name with 100 characters or less."
 msgstr ""
 
-#: warehouse/accounts/forms.py:439
+#: warehouse/accounts/forms.py:440
 msgid "Invalid TOTP code."
 msgstr ""
 
-#: warehouse/accounts/forms.py:456
+#: warehouse/accounts/forms.py:457
 msgid "Invalid WebAuthn assertion: Bad payload"
 msgstr ""
 
-#: warehouse/accounts/forms.py:525
+#: warehouse/accounts/forms.py:526
 msgid "Invalid recovery code."
 msgstr ""
 
-#: warehouse/accounts/forms.py:534
+#: warehouse/accounts/forms.py:535
 msgid "Recovery code has been previously used."
 msgstr ""
 
-#: warehouse/accounts/forms.py:564
+#: warehouse/accounts/forms.py:565
 msgid "The username isn't valid. Try again."
 msgstr ""