400 Bad Request for invalid database names

package.json

@@ -64,7 +64,6 @@
     "promise-nodify": "^1.0.2",
     "random-uuid-v4": "0.0.6",
     "raw-body": "^2.2.0",
-    "sanitize-filename": "^1.6.1",
     "serve-favicon": "~2.3.2",
     "tail": "^1.2.1",
     "uuid": "^3.0.1",

tests/express-pouchdb/test.js

@@ -260,6 +260,42 @@ describe('redirects', function () {
   });
 });
 
+describe('invalid databases (#213)', function () {
+  it('GET /_invalid should return 400 Bad Request', function (done) {
+    request(coreApp)
+      .get('/_invalid')
+      .expect(400)
+      .expect(function (res) {
+        var error = JSON.parse(res.text);
+        if (error.error !== 'illegal_database_name') {
+          return 'should return "illegal_database_name" error';
+        }
+        if (!/Name: '_invalid'/.test(error.reasons)) {
+          return 'should return "reason"';
+        }
+      })
+      .end(done);
+  });
+
+  it('GET /_internal should not return 400 Bad Request', function (done) {
+    // router handler is never called because it’s already handled by the
+    // `GET /:db` handler which returns a 404, as no `_internal` db exists
+    coreApp.get('/_internal', function () {});
+
+    request(coreApp)
+      .get('/_internal')
+      .expect(404)
+      .end(done);
+  });
+
+  it('GET /user%2Fabc4567 should not return 400 Bad Request', function (done) {
+    request(coreApp)
+      .get('/user%2Fabc4567')
+      .expect(404)
+      .end(done);
+  });
+});
+
 function assertException(func, re) {
   var e;
   try {