[WEB-4434] chore: disallowing special characters in user first name and last name

apps/api/plane/app/serializers/user.py

@@ -1,3 +1,7 @@
+# Python imports
+import re
+
+
 # Third party imports
 from rest_framework import serializers
 
@@ -7,16 +11,29 @@
 
 from .base import BaseSerializer
 
+# Regex pattern to block the following special characters in names:
+# & + , : ; $ ^ } { * = ? @ # | ' < > . ( ) % !
+
+FORBIDDEN_NAME_CHARS_PATTERN = r"^.*[&+,:;$^}{*=?@#|'<>.()%!].*$"
+
 
 class UserSerializer(BaseSerializer):
     def validate_first_name(self, value):
         if contains_url(value):
             raise serializers.ValidationError("First name cannot contain a URL.")
+
+        if re.match(FORBIDDEN_NAME_CHARS_PATTERN, value):
+            raise serializers.ValidationError("First name cannot contain special characters.")
+
         return value
 
     def validate_last_name(self, value):
         if contains_url(value):
             raise serializers.ValidationError("Last name cannot contain a URL.")
+
+        if re.match(FORBIDDEN_NAME_CHARS_PATTERN, value):
+            raise serializers.ValidationError("Last name cannot contain special characters.")
+
         return value
 
     class Meta: