Flagsmith / Flagsmith/flagsmith
Spike: Re-approach identifier sanitization
- Dominant language
- Python
- Stars
- 6.6k
- Forks
- 567
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 121
Description
## Context
1. We have recently released identifiers sanitization to **core API** (https://github.com/Flagsmith/flagsmith/issues/5490).
- We had to follow up with allowing white spaces (https://github.com/Flagsmith/flagsmith/issues/6082).
- We ended up with [this validation regular expression](https://github.com/Flagsmith/edge-api/blob/55b608b44a962b3441d1a3d27f10a7df937ff0fb/src/types.py#L13).
1. On 2025-09-18, we released it to edge-api, but had to revert immediately due to reports of the introduced validation error hindering application functionality on SaaS.
- Reverted in edge-api (could be one PR but there was heat)
- https://github.com/Flagsmith/edge-api/pull/466
- https://github.com/Flagsmith/edge-api/pull/467
- Reverted in core (https://github.com/Flagsmith/flagsmith/pull/6085).
## Goals
1. Discuss the correct validation rule.
- Collect every symbol (`\W`) used in identifiers from production, ensuring the new regular expression won't miss existing use cases.
1. Cherry-pick the work mentioned above with the correct regular expression.
1. Improve documentation to specify validation rules around identifiers.
Contributor guide
Assessment
This issue has not been assessed yet.