[OSM-dev] usernames, keys, and values

[Anthony]

On Wed, Oct 28, 2009 at 11:38 AM, Andy Allan <gravitystorm at gmail.com> wrote:
> I would say that if the dump code and
> http://www.w3.org/TR/REC-xml/#NT-Char
> are in conflict, there's a bug in the dump code.

W3 determines what's legal XML, it doesn't determine what's legal as
an OSM username.  For example, W3 obviously allows strings of 2
characters.  But an OSM username must be at least 3 characters.

> As for the rails code, there is (AFAIK) no explicit character
> checking. The server implicitly relies on libxml to ensure the
> characters in the XML requests and responses are only those allowed by
> the XML spec above.

I'm not concerned about what is allowed in the XML requests and
responses.  I'm concerned about what's allowed in an OSM username,
[tag] key, and [tag] value.

I just tried changing my display name to "<b>hello</b>".  I get an
error "Display Name is invalid".

That's certainly a string which can be encoded in XML using libxml.