From ef5727fd6b62cf14e369297e3f01ca482f3c0560 Mon Sep 17 00:00:00 2001
From: yzqzss <yzqzss@yandex.com>
Date: Mon, 23 Dec 2024 15:02:32 +0800
Subject: [PATCH] disallow 'xml' prefix

---
 pkg/metadata/key.go      | 9 +++++++--
 pkg/metadata/key_test.go | 3 ++-
 pkg/metadata/metadata.go | 2 +-
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/pkg/metadata/key.go b/pkg/metadata/key.go
index 7cdb8a8..d8d5509 100644
--- a/pkg/metadata/key.go
+++ b/pkg/metadata/key.go
@@ -31,7 +31,8 @@ var KeyHyphenWithUnderscoreError = errors.New("Key contains -_ or _-, which is n
 // Although we can create an item metadata keys starting with underscore via the S3 API,
 // it would lead to an corrupted _meta.xml. (like `<_key>value</_key>`) and IA's /editxml/
 // tool would also prevent you from editing the metadata before you fix the key.
-var KeyInvalidStartError = errors.New("Key must start with a lowercase a-z letter")
+// `xml` is a XML 1.1 reserved prefix.
+var KeyInvalidStartError = errors.New("Key must start with a lowercase a-z letter and may not start with 'xml'")
 
 // IA's metadata keys are always lowercase.
 // If you try to create a metadata key with uppercase letters, IA will normalize it to lowercase.
@@ -44,7 +45,7 @@ var KeyInllegalCharError = errors.New("Key contains illegal characters")
 var KeyTooLongError = errors.New("Key is too long")
 
 // TODO: Item Metadata API option
-func isValidKey(k string) error {
+func IsValidKey(k string) error {
 	if len(k) == 0 {
 		return KeyEmptyError
 	}
@@ -62,6 +63,10 @@ func isValidKey(k string) error {
 		return KeyInvalidStartError
 	}
 
+	if strings.HasPrefix(k, "xml") {
+		return KeyInvalidStartError
+	}
+
 	for _, c := range k[1:] {
 		if c >= 'a' && c <= 'z' {
 			continue
diff --git a/pkg/metadata/key_test.go b/pkg/metadata/key_test.go
index e2f3d6e..67f1069 100644
--- a/pkg/metadata/key_test.go
+++ b/pkg/metadata/key_test.go
@@ -16,6 +16,7 @@ func Test_IsValidKey(t *testing.T) {
 		{"a-_b", KeyHyphenWithUnderscoreError},
 		{"a_-b", KeyHyphenWithUnderscoreError},
 		{"123abc", KeyInvalidStartError},
+		{"xmlabc", KeyInvalidStartError},
 		{"ABC123", KeyuUpcaseError},
 		{"abc___123", nil},
 		{"avr-123dc_adsd923-sd2.312-123.123_123", nil},
@@ -25,7 +26,7 @@ func Test_IsValidKey(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.key, func(t *testing.T) {
-			if err := isValidKey(tt.key); err != tt.errW {
+			if err := IsValidKey(tt.key); err != tt.errW {
 				t.Fatalf("want %v, got %v", tt.errW, err)
 			}
 		})
diff --git a/pkg/metadata/metadata.go b/pkg/metadata/metadata.go
index 348a8fa..3ab2ef3 100644
--- a/pkg/metadata/metadata.go
+++ b/pkg/metadata/metadata.go
@@ -10,7 +10,7 @@ var ErrEmptyValue = errors.New("empty value")
 var ErrNLessThanOne = errors.New("n must be greater than 0")
 
 func toS3HeaderKey(k string, n int) (string, error) {
-	if err := isValidKey(k); err != nil {
+	if err := IsValidKey(k); err != nil {
 		return "", err
 	}
 	if n < 1 {