From d7c74ca3ad65dc8cc0366d321c5494c4f3b7a51b Mon Sep 17 00:00:00 2001
From: Koen Kanters <koenkanters94@gmail.com>
Date: Fri, 8 Jan 2021 20:46:04 +0100
Subject: [PATCH] Fix not allowed friendly_names being allowed. #5618

---
 lib/util/utils.js   |  6 ++++++
 test/bridge.test.js | 11 +++++++++++
 2 files changed, 17 insertions(+)

diff --git a/lib/util/utils.js b/lib/util/utils.js
index 07f1780d..6d61c185 100644
--- a/lib/util/utils.js
+++ b/lib/util/utils.js
@@ -190,6 +190,12 @@ function toSnakeCase(value) {
 
 function validateFriendlyName(name) {
     const errors = [];
+    for (const endpointName of endpointNames) {
+        if (name.toLowerCase().endsWith('/' + endpointName)) {
+            errors.push(`friendly_name is not allowed to end with: '/${endpointName}'`);
+        }
+    }
+
     if (endpointNames.includes(name)) errors.push(`Following friendly_name are not allowed: '${endpointNames}'`);
     if (name.match(/.*\/\d*$/)) errors.push(`Friendly name cannot end with a "/DIGIT" ('${name}')`);
     if (name.includes('#') || name.includes('+')) {
diff --git a/test/bridge.test.js b/test/bridge.test.js
index 89db4436..178d19ab 100644
--- a/test/bridge.test.js
+++ b/test/bridge.test.js
@@ -474,6 +474,17 @@ describe('Bridge', () => {
         );
     });
 
+    it('Shouldnt allow rename device with to now allowed name', async () => {
+        MQTT.publish.mockClear();
+        MQTT.events.message('zigbee2mqtt/bridge/request/device/rename', stringify({from: 'bulb', to: 'living_room/blinds/center'}));
+        await flushPromises();
+        expect(MQTT.publish).toHaveBeenCalledWith(
+            'zigbee2mqtt/bridge/response/device/rename',
+            stringify({"data":{},"status":"error","error":"friendly_name is not allowed to end with: '/center'"}),
+            {retain: false, qos: 0}, expect.any(Function)
+        );
+    });
+
     it('Should allow rename group', async () => {
         MQTT.publish.mockClear();
         MQTT.events.message('zigbee2mqtt/bridge/request/group/rename', stringify({from: 'group_1', to: 'group_new_name'}));