From 53d919f8c14c6a02becfe13c01ad2b4260efdb38 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Feb 22 2018 10:36:38 +0000
Subject: Don't treat @ in the middle of words as a mention


If there's a user called 'example', then *any* occurence of the
string `@example` followed by a non-word character is treated
as a mention. This is not how we handle this for anything else
(e.g. issue or PR links) and has some obvious weird effects...
like the string `someone@example.com` is treated as a mention
of the user @example. So, let's not do that any more (by using
the same negative lookbehind we use for other things).

Also, drop the leading space from the `text` definition used in
the pattern's `handleMatch()`. The regex doesn't capture any
character before the @ and has not done for a long time, if it
ever did, so this is just wrong. If you look at the raw page
source of any Pagure page with an @mention in it, you can see
that there's a bogus extra space before the @ due to this,
though it seems that browsers (at least Firefox) strip it when
rendering the HTML.

Also add an explanation of what these negative lookbehinds we
keep using are for, and how they work, since here above the
first regex is a logical place, and @pingou asked for one...

Signed-off-by: Adam Williamson <awilliam@redhat.com>

---

diff --git a/pagure/pfmarkdown.py b/pagure/pfmarkdown.py
index 9fe6ddf..3d342a5 100644
--- a/pagure/pfmarkdown.py
+++ b/pagure/pfmarkdown.py
@@ -31,9 +31,16 @@ import pagure.lib
 from pagure.config import config as pagure_config
 
 
-MENTION_RE = r'@(\w+)'
+# the (?<!\w) (and variants) we use a lot in all these regexes is a
+# negative lookbehind assertion. It means 'match when the preceding
+# character is not in the \w class'. This stops us from starting a
+# match in the middle of a word (e.g. someone@something in the
+# MENTION_RE regex). Note that it is a zero-length match - it does
+# not capture or consume any of the string - and it does not appear
+# as a group for the match object.
+MENTION_RE = r'(?<!\w)@(\w+)'
 # Each line below correspond to a line of the regex:
-#  1) Ensure we catch the motif from the start
+#  1) Don't start matching in the middle of a word
 #  2) See if there is a `forks/` at the start
 #  3) See if we have a `user/`
 #  4) See if we have a `namespace/`
@@ -68,7 +75,7 @@ class MentionPattern(markdown.inlinepatterns.Pattern):
     def handleMatch(self, m):
         """ When the pattern matches, update the text. """
         name = markdown.util.AtomicString(m.group(2))
-        text = ' @%s' % name
+        text = '@%s' % name
         user = pagure.lib.search_user(flask.g.session, username=name)
         if not user:
             return text
diff --git a/tests/test_pagure_lib.py b/tests/test_pagure_lib.py
index 8d20c89..784b38f 100644
--- a/tests/test_pagure_lib.py
+++ b/tests/test_pagure_lib.py
@@ -4235,6 +4235,9 @@ class PagureLibtests(tests.Modeltests):
             "NoSuchDynamicUser'~~",
             '``~~foo bar~~``',
             '~~foo bar~~ and ~~another ~~',
+            'lets mention @pingou',
+            '@pingou at start of line',
+            'but not someone@pingou.com',
         ]
         expected = [
             # 'foo bar test#1 see?',
@@ -4319,6 +4322,12 @@ class PagureLibtests(tests.Modeltests):
             '<p><code>~~foo bar~~</code></p>',
             # '~~foo bar~~ and ~~another ~~',
             '<p><del>foo bar</del> and <del>another </del></p>',
+            # 'lets mention @pingou',
+            '<p>lets mention <a href="https://pagure.org/user/pingou">@pingou</a></p>',
+            # '@pingou at start of line',
+            '<p><a href="https://pagure.org/user/pingou">@pingou</a> at start of line</p>',
+            # 'but not someone@pingou.com',
+            '<p>but not someone@pingou.com</p>',
         ]
 
         with self.app.application.app_context():