1 files changed, 15 insertions, 1 deletions

diff --git a/src/mailman/app/lifecycle.py b/src/mailman/app/lifecycle.py
index 79ab20c8a..cfa01531b 100644
--- a/src/mailman/app/lifecycle.py
+++ b/src/mailman/app/lifecycle.py
@@ -17,12 +17,14 @@
 
 """Application level list creation."""
 
+import re
 import shutil
 import logging
 
 from contextlib import suppress
 from mailman.config import config
-from mailman.interfaces.address import IEmailValidator
+from mailman.interfaces.address import (
+    IEmailValidator, InvalidEmailAddressError)
 from mailman.interfaces.domain import (
     BadDomainSpecificationError, IDomainManager)
 from mailman.interfaces.listmanager import IListManager
@@ -35,6 +37,12 @@ from zope.component import getUtility
 
 
 log = logging.getLogger('mailman.error')
+# These are the only characters allowed in list names.
+_listname_chars = re.compile('[-0-9a-z_.]', re.IGNORECASE)
+
+
+class InvalidListNameError(InvalidEmailAddressError):
+    """List name is invalid."""
 
 
 @public
@@ -57,6 +65,8 @@ def create_list(fqdn_listname, owners=None, style_name=None):
         `fqdn_listname` does not exist.
     :raises ListAlreadyExistsError: when the mailing list already exists.
     :raises InvalidEmailAddressError: when the fqdn email address is invalid.
+    :raises InvalidListNameError: when the fqdn email address is valid but the
+        listname contains disallowed characters.
     """
     if owners is None:
         owners = []
@@ -64,6 +74,10 @@ def create_list(fqdn_listname, owners=None, style_name=None):
     # posting address.  Let these percolate up.
     getUtility(IEmailValidator).validate(fqdn_listname)
     listname, domain = fqdn_listname.split('@', 1)
+    # We need to be fussier than just validating the posting address.  Various
+    # legal local-part characters will cause problems in list names.
+    if len(_listname_chars.sub('', listname)) > 0:
+        raise InvalidListNameError(listname)
     if domain not in getUtility(IDomainManager):
         raise BadDomainSpecificationError(domain)
     mlist = getUtility(IListManager).create(fqdn_listname)