diff --git a/supervisor/mounts/validate.py b/supervisor/mounts/validate.py index b64e7f261..5a61e8ed6 100644 --- a/supervisor/mounts/validate.py +++ b/supervisor/mounts/validate.py @@ -27,7 +27,7 @@ from .const import ( MountUsage, ) -RE_MOUNT_NAME = re.compile(r"^\w+$") +RE_MOUNT_NAME = re.compile(r"^[A-Za-z0-9_]+$") RE_PATH_PART = re.compile(r"^[^\\\/]+") RE_MOUNT_OPTION = re.compile(r"^[^,=]+$") diff --git a/tests/api/test_mounts.py b/tests/api/test_mounts.py index 28ce34a5c..39c995b34 100644 --- a/tests/api/test_mounts.py +++ b/tests/api/test_mounts.py @@ -711,3 +711,27 @@ async def test_options(api_client: TestClient, coresys: CoreSys, mount): assert coresys.mounts.default_backup_mount is None assert coresys.mounts.save_data.call_count == 2 + + +async def test_api_create_mount_fails_special_chars( + api_client: TestClient, + coresys: CoreSys, + tmp_supervisor_data, + path_extern, + mount_propagation, +): + """Test creating a mount via API fails with special characters.""" + resp = await api_client.post( + "/mounts", + json={ + "name": "Überwachungskameras", + "type": "cifs", + "usage": "backup", + "server": "backup.local", + "share": "backups", + "version": "2.0", + }, + ) + result = await resp.json() + assert result["result"] == "error" + assert "does not match regular expression" in result["message"]