From b939e9e3b42a60c6d107c7d8e2fa46e87810e93b Mon Sep 17 00:00:00 2001
From: Junaid Ahamed <junuhammad2@gmail.com>
Date: Thu, 12 Nov 2026 14:27:37 +0530
Subject: [PATCH] fix(utils): allow apostrophes in person names

---
 packages/utils/package.json           |  6 +-
 packages/utils/src/validation.test.ts | 82 +++++++++++++++++++++++++++
 packages/utils/src/validation.ts      |  5 +-
 pnpm-lock.yaml                        |  4 ++
 4 files changed, 93 insertions(+), 4 deletions(-)
 create mode 100644 packages/utils/src/validation.test.ts

diff --git a/packages/utils/package.json b/packages/utils/package.json
index b65214a659c2..61f98e4eefef 100644
--- a/packages/utils/package.json
+++ b/packages/utils/package.json
@@ -20,7 +20,8 @@
     "check:format": "oxfmt --check .",
     "fix:lint": "oxlint --fix .",
     "fix:format": "oxfmt .",
-    "clean": "rm -rf .turbo && rm -rf node_modules && rm -rf dist"
+    "clean": "rm -rf .turbo && rm -rf node_modules && rm -rf dist",
+    "test": "vitest run"
   },
   "dependencies": {
     "@makeplane/propel": "catalog:",
@@ -53,6 +54,7 @@
     "@types/react": "catalog:",
     "@types/sanitize-html": "catalog:",
     "tsdown": "catalog:",
-    "typescript": "catalog:"
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   }
 }
diff --git a/packages/utils/src/validation.test.ts b/packages/utils/src/validation.test.ts
new file mode 100644
index 000000000000..9866771fe8ac
--- /dev/null
+++ b/packages/utils/src/validation.test.ts
@@ -0,0 +1,82 @@
+/**
+ * Copyright (c) 2023-present Plane Software, Inc. and contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ * See the LICENSE file for details.
+ */
+
+import { describe, expect, it } from "vitest";
+import {
+  hasInjectionRiskChars,
+  validateCompanyName,
+  validateDisplayName,
+  validateOptionalPersonName,
+  validatePersonName,
+  validateSlug,
+  validateWorkspaceName,
+} from "./validation";
+
+describe("validatePersonName", () => {
+  it.each(["O'Brien", "D'Arcy", "Jean-Paul", "José", "李明", "محمد", " John ", "John\tPaul", "John\nPaul", "---"])(
+    "accepts names allowed by the existing pattern: %j",
+    (name) => {
+      expect(validatePersonName(name)).toBe(true);
+      expect(validateOptionalPersonName(name)).toBe(true);
+    }
+  );
+
+  it.each(["<", ">", '"', "{", "}", "[", "]", "*", "^", "!", "#", "%"])(
+    "still rejects %j when combined with an apostrophe",
+    (character) => {
+      const name = `O'Brien${character}`;
+      expect(validatePersonName(name)).toBe('Names cannot contain special characters like < > " { } [ ] * ^ ! # %');
+      expect(validateOptionalPersonName(name)).not.toBe(true);
+    }
+  );
+
+  it.each([
+    "O'Brien<script>",
+    "O'Brien1",
+    "O'Brien_",
+    "O'Brien.",
+    "O'Brien/",
+    "O'Brien\\",
+    "O’Brien",
+    "https://example.com",
+    "O'Brien\0",
+    "O'Brien\u0001",
+  ])("preserves rejection of unsupported characters: %j", (name) => {
+    expect(validatePersonName(name)).not.toBe(true);
+    expect(validateOptionalPersonName(name)).not.toBe(true);
+  });
+
+  it("counts apostrophes toward the existing 50-character limit", () => {
+    const name = `O'${"a".repeat(48)}`;
+    expect(validatePersonName(name)).toBe(true);
+    expect(validateOptionalPersonName(name)).toBe(true);
+    expect(validatePersonName(`${name}a`)).toBe("Name must be 50 characters or less");
+    expect(validateOptionalPersonName(`${name}a`)).toBe("Name must be 50 characters or less");
+  });
+
+  it.each(["", " ", "\t\n"])("preserves required and optional blank handling: %j", (name) => {
+    expect(validatePersonName(name)).toBe("Name is required");
+    expect(validateOptionalPersonName(name)).toBe(true);
+  });
+
+  it("allows omitted optional names", () => {
+    expect(validateOptionalPersonName()).toBe(true);
+  });
+});
+
+describe("other input validators", () => {
+  it("keeps apostrophes rejected by the shared guard", () => {
+    expect(hasInjectionRiskChars("O'Brien")).toBe(true);
+  });
+
+  it.each([validateDisplayName, validateCompanyName, validateWorkspaceName, validateSlug])(
+    "keeps apostrophes rejected outside person names",
+    (validate) => {
+      expect(validate("O'Brien")).not.toBe(true);
+      expect(validate("Acme")).toBe(true);
+    }
+  );
+});
diff --git a/packages/utils/src/validation.ts b/packages/utils/src/validation.ts
index 1d0faaf3a390..7ff7d135e45c 100644
--- a/packages/utils/src/validation.ts
+++ b/packages/utils/src/validation.ts
@@ -78,8 +78,9 @@ export const validatePersonName = (name: string): boolean | string => {
     return "Name must be 50 characters or less";
   }
 
-  if (hasInjectionRiskChars(name)) {
-    return "Names cannot contain special characters like < > ' \" { } [ ] * ^ ! # %";
+  // Apostrophes are allowed in person names; keep the shared guard unchanged for other fields.
+  if (hasInjectionRiskChars(name.replaceAll("'", ""))) {
+    return 'Names cannot contain special characters like < > " { } [ ] * ^ ! # %';
   }
 
   if (!PERSON_NAME_REGEX.test(name)) {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 2873c0ee1220..11ee066682c3 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1763,6 +1763,10 @@ importers:
       typescript:
         specifier: 5.8.3
         version: 5.8.3
+      vitest:
+        specifier: 'catalog:'
+        version: 4.1.12(@opentelemetry/api@1.9.1)(@types/node@22.12.0)(@vitest/coverage-v8@4.1.12)(happy-dom@21.0.4)(jsdom@23.2.0)(vite@8.2.4(@types/node@22.12.0)(esbuild@0.28.1)(jiti@2.7.0)(terser@5.43.1)(tsx@4.20.6)(yaml@2.8.3))
+
 
 packages: