feat: reject padded reward owner metadata

Author: MikelCalvo

internal/minimal/shared_world.go

@@ -931,7 +931,7 @@ func (r *sharedWorldRegistry) RegisterGroundGold(ownerID uint64, ownerLogin stri
 }
 
 func (r *sharedWorldRegistry) registerGroundItem(ownerID uint64, ownerLogin string, character loginticket.Character, vid uint32, item inventory.ItemInstance, goldAmount uint32) bool {
-	if r == nil || ownerID == 0 || strings.TrimSpace(ownerLogin) == "" || strings.TrimSpace(character.Name) == "" || vid == 0 || item.Vnum == 0 {
+	if r == nil || ownerID == 0 || ownerLogin == "" || ownerLogin != strings.TrimSpace(ownerLogin) || character.Name == "" || character.Name != strings.TrimSpace(character.Name) || vid == 0 || item.Vnum == 0 {
 		return false
 	}
 

internal/minimal/shared_world_test.go

@@ -527,6 +527,27 @@ func TestSharedWorldRegistryRegisterGroundRewardsRejectsBlankOwnerName(t *testin
 	}
 }
 
+func TestSharedWorldRegistryRegisterGroundRewardsRejectsPaddedOwnerMetadata(t *testing.T) {
+	registry := newSharedWorldRegistry()
+	owner := peerVisibilityCharacter("PaddedNameRewardOwner", 0x010301a2, 0x020401a2, 1200, 2200, 0, 101, 201)
+	ownerID, _ := registry.Join(owner, newPendingServerFrames(), nil)
+	if ownerID == 0 {
+		t.Fatal("expected padded-metadata reward owner join to allocate a shared-world entity id")
+	}
+
+	paddedNameOwner := owner
+	paddedNameOwner.Name = " PaddedNameRewardOwner "
+	if registry.RegisterGroundItem(ownerID, "padded-metadata-owner", paddedNameOwner, 0x07000023, inventory.ItemInstance{Vnum: 3001, Count: 1}) {
+		t.Fatal("expected padded owner-name ground-item reward registration to fail closed")
+	}
+	if registry.RegisterGroundGold(ownerID, " padded-metadata-owner ", owner, 0x07000024, 250) {
+		t.Fatal("expected padded owner-login ground-gold reward registration to fail closed")
+	}
+	if registry.GroundItemExists(0x07000023) || registry.GroundItemExists(0x07000024) {
+		t.Fatal("expected rejected padded-metadata reward ground entries to stay absent")
+	}
+}
+
 func TestSharedWorldRegistryRegisterGroundRewardsRejectsStaleLiveOwnerSnapshotAfterOwnerDeath(t *testing.T) {
 	registry := newSharedWorldRegistry()
 	owner := peerVisibilityCharacter("StaleLiveRewardOwner", 0x01030193, 0x02040193, 1200, 2200, 0, 101, 201)

spec/protocol/non-player-reward-bootstrap.md

@@ -56,8 +56,8 @@ Reward descriptors fail closed when:
 - any `reward_drop_vnums` entry is `0`
 - any `reward_drop_vnums` entry is duplicated in the same descriptor
 - a runtime-generated ground-entry VID for a configured item-shaped or gold-shaped drop would be `0`
-- the reward owner login is empty or blank after trimming whitespace when registering a configured item-shaped or gold-shaped drop
-- the reward owner character name is empty or blank after trimming whitespace when registering a configured item-shaped or gold-shaped drop
+- the reward owner login is empty, blank after trimming whitespace, or padded with leading/trailing whitespace when registering a configured item-shaped or gold-shaped drop
+- the reward owner character name is empty, blank after trimming whitespace, or padded with leading/trailing whitespace when registering a configured item-shaped or gold-shaped drop
 - a runtime-generated ground-item instance for a configured item-shaped drop would have `vnum = 0`
 - a runtime-generated ground-item instance for a configured item-shaped drop would have zero count
 - a runtime-generated ground-item instance for a configured item-shaped drop would exceed the current `GC ITEM_GET` count carrier (`255`)