From 7c37ececfd3642f48345303b54e3cae7d5458fa1 Mon Sep 17 00:00:00 2001
From: Alan Bernstein <alan.aaron.bernstein@gmail.com>
Date: Fri, 10 Jul 2020 17:58:47 -0500
Subject: [PATCH 1/2] Restrict allowed characters in transaction IDs

---
 pilosa.go      | 3 +--
 transaction.go | 7 +++++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/pilosa.go b/pilosa.go
index 481c8ff07..f7eb33f43 100644
--- a/pilosa.go
+++ b/pilosa.go
@@ -53,8 +53,7 @@ var (
 	ErrInvalidView      = errors.New("invalid view")
 	ErrInvalidCacheType = errors.New("invalid cache type")
 
-	ErrName  = errors.New("invalid index or field name, must match [a-z][a-z0-9_-]* and contain at most 230 characters")
-	ErrLabel = errors.New("invalid row or column label, must match [A-Za-z0-9_-]")
+	ErrName = errors.New("invalid index or field name, must match [a-z][a-z0-9_-]* and contain at most 230 characters")
 
 	// ErrFragmentNotFound is returned when a fragment does not exist.
 	ErrFragmentNotFound = errors.New("fragment not found")
diff --git a/transaction.go b/transaction.go
index ba7063907..1923bf91b 100644
--- a/transaction.go
+++ b/transaction.go
@@ -17,6 +17,7 @@ package pilosa
 import (
 	"context"
 	"encoding/json"
+	"regexp"
 	"sync"
 	"time"
 
@@ -24,6 +25,8 @@ import (
 	"github.com/pkg/errors"
 )
 
+var txIDRegexp = regexp.MustCompile("^[A-Za-z0-9_-]$")
+
 // Transaction contains information related to a block of work that
 // needs to be tracked and spans multiple API calls.
 type Transaction struct {
@@ -93,6 +96,10 @@ func (tm *TransactionManager) Start(ctx context.Context, id string, timeout time
 	tm.mu.Lock()
 	defer tm.mu.Unlock()
 
+	if !txIDRegexp.Match([]byte(id)) {
+		return nil, errors.New("invalid transaction ID, must match [A-Za-z0-9_-]")
+	}
+
 	trnsMap, err := tm.store.List()
 	if err != nil {
 		return nil, errors.Wrap(err, "listing transactions in Start")

From 65febc37fd9d0db2003811b39720347bb936ee84 Mon Sep 17 00:00:00 2001
From: Alan Bernstein <alan.aaron.bernstein@gmail.com>
Date: Fri, 10 Jul 2020 18:07:17 -0500
Subject: [PATCH 2/2] Allow '' in ID regex

---
 transaction.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/transaction.go b/transaction.go
index 1923bf91b..2af2c76df 100644
--- a/transaction.go
+++ b/transaction.go
@@ -25,7 +25,7 @@ import (
 	"github.com/pkg/errors"
 )
 
-var txIDRegexp = regexp.MustCompile("^[A-Za-z0-9_-]$")
+var txIDRegexp = regexp.MustCompile("^[A-Za-z0-9_-]*$")
 
 // Transaction contains information related to a block of work that
 // needs to be tracked and spans multiple API calls.