3 files changed, 24 insertions, 2 deletions

diff --git a/src/mailman/app/lifecycle.py b/src/mailman/app/lifecycle.py
index 79ab20c8a..cfa01531b 100644
--- a/src/mailman/app/lifecycle.py
+++ b/src/mailman/app/lifecycle.py
@@ -17,12 +17,14 @@
 
 """Application level list creation."""
 
+import re
 import shutil
 import logging
 
 from contextlib import suppress
 from mailman.config import config
-from mailman.interfaces.address import IEmailValidator
+from mailman.interfaces.address import (
+    IEmailValidator, InvalidEmailAddressError)
 from mailman.interfaces.domain import (
     BadDomainSpecificationError, IDomainManager)
 from mailman.interfaces.listmanager import IListManager
@@ -35,6 +37,12 @@ from zope.component import getUtility
 
 
 log = logging.getLogger('mailman.error')
+# These are the only characters allowed in list names.
+_listname_chars = re.compile('[-0-9a-z_.]', re.IGNORECASE)
+
+
+class InvalidListNameError(InvalidEmailAddressError):
+    """List name is invalid."""
 
 
 @public
@@ -57,6 +65,8 @@ def create_list(fqdn_listname, owners=None, style_name=None):
         `fqdn_listname` does not exist.
     :raises ListAlreadyExistsError: when the mailing list already exists.
     :raises InvalidEmailAddressError: when the fqdn email address is invalid.
+    :raises InvalidListNameError: when the fqdn email address is valid but the
+        listname contains disallowed characters.
     """
     if owners is None:
         owners = []
@@ -64,6 +74,10 @@ def create_list(fqdn_listname, owners=None, style_name=None):
     # posting address.  Let these percolate up.
     getUtility(IEmailValidator).validate(fqdn_listname)
     listname, domain = fqdn_listname.split('@', 1)
+    # We need to be fussier than just validating the posting address.  Various
+    # legal local-part characters will cause problems in list names.
+    if len(_listname_chars.sub('', listname)) > 0:
+        raise InvalidListNameError(listname)
     if domain not in getUtility(IDomainManager):
         raise BadDomainSpecificationError(domain)
     mlist = getUtility(IListManager).create(fqdn_listname)
diff --git a/src/mailman/app/tests/test_lifecycle.py b/src/mailman/app/tests/test_lifecycle.py
index f504e3dfd..db36d0b64 100644
--- a/src/mailman/app/tests/test_lifecycle.py
+++ b/src/mailman/app/tests/test_lifecycle.py
@@ -21,7 +21,8 @@ import os
 import shutil
 import unittest
 
-from mailman.app.lifecycle import create_list, remove_list
+from mailman.app.lifecycle import (
+    InvalidListNameError, create_list, remove_list)
 from mailman.interfaces.address import InvalidEmailAddressError
 from mailman.interfaces.domain import BadDomainSpecificationError
 from mailman.interfaces.listmanager import IListManager
@@ -39,6 +40,12 @@ class TestLifecycle(unittest.TestCase):
         self.assertRaises(InvalidEmailAddressError,
                           create_list, 'bogus address')
 
+    def test_listname_validation(self):
+        # Creating a mailing list with invalid characters in the listname
+        # raises an exception.
+        self.assertRaises(InvalidListNameError,
+                          create_list, 'my/list@example.com')
+
     def test_unregistered_domain(self):
         # Creating a list with an unregistered domain raises an exception.
         self.assertRaises(BadDomainSpecificationError,
diff --git a/src/mailman/docs/NEWS.rst b/src/mailman/docs/NEWS.rst
index d2d4a39d2..14d995190 100644
--- a/src/mailman/docs/NEWS.rst
+++ b/src/mailman/docs/NEWS.rst
@@ -109,6 +109,7 @@ Bugs
  * Fix ``mailman stop`` not stopping some runners due to PEP 475 interaction.
    (Closes: #255)
  * Update documentation links for ``config.cfg`` settings.  (Closes: #306)
+ * Disallow problematic characters in listnames.  (Closes: #311)
 
 Configuration
 -------------