The only illegal characters in a username are ":" (field separator), "\n" (line separator), and "/" (filename separator).

Restricting usernames to the legacy posix character allowed set (for filenames,
so the $HOME directory is creatable on VFAT and similar) means you can't have
UTF-8 usernames. Linux allows any character but / and NUL in filenames.
Since root is creating these entries, we assume root knows what it's doing.

1 files changed, 5 insertions, 4 deletions

diff --git a/toys/pending/groupadd.c b/toys/pending/groupadd.c
index 04c31ee5..7df0a5c3 100644
--- a/toys/pending/groupadd.c
+++ b/toys/pending/groupadd.c
@@ -92,11 +92,12 @@ void groupadd_main(void)
     update_password(SECURE_GROUP_PATH, grp->gr_name, entry);
     free(entry);
   } else {    //new group to be created
+    char *s = *toys.optargs;
+
     /* investigate the group to be created */
-    if ((grp = getgrnam(*toys.optargs))) 
-      error_exit("group '%s' is in use", *toys.optargs);
-    setlocale(LC_ALL, "C");
-    is_valid_username(*toys.optargs);
+    if (getgrnam(s)) error_exit("'%s' in use", s);
+    if (s[strcspn(s, ":/\n")] || strlen(s) > LOGIN_NAME_MAX)
+      error_exit("bad name");
     new_group();
   }
 }