audit and harden workspace

all/cmd/main/main.go

@@ -3,9 +3,11 @@ package main
 import (
 	"context"
 	"flag"
+	"fmt"
 	"net/http"
 	"os"
 	"os/signal"
+	"regexp"
 	"strings"
 	"syscall"
 	"time"
@@ -18,12 +20,24 @@ import (
 
 var ServiceKey = "default"
 
+var workspacePattern = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$`)
+
+func normalizeWorkspace(value string) (string, error) {
+	value = strings.ToLower(strings.TrimSpace(value))
+	if !workspacePattern.MatchString(value) {
+		return "", fmt.Errorf("workspace must match %s", workspacePattern.String())
+	}
+	return value, nil
+}
+
 func main() {
 	workspace := flag.String("workspace", ServiceKey, "workspace used to select etc/{workspace}_{runtime}.yaml")
 	flag.Parse()
-	if value := strings.TrimSpace(*workspace); value != "" {
-		ServiceKey = value
+	value, err := normalizeWorkspace(*workspace)
+	if err != nil {
+		panic(err)
 	}
+	ServiceKey = value
 
 	config.New(ServiceKey)
 	impl.NewImpl()

all/cmd/main/main_test.go

@@ -0,0 +1,26 @@
+package main
+
+import "testing"
+
+func TestNormalizeWorkspace(t *testing.T) {
+	tests := []struct {
+		input string
+		want  string
+		ok    bool
+	}{
+		{input: "default", want: "default", ok: true},
+		{input: " Tenant_01 ", want: "tenant_01", ok: true},
+		{input: "../prod", ok: false},
+		{input: "", ok: false},
+		{input: "tenant.name", ok: false},
+	}
+	for _, test := range tests {
+		got, err := normalizeWorkspace(test.input)
+		if (err == nil) != test.ok {
+			t.Fatalf("normalizeWorkspace(%q) error = %v", test.input, err)
+		}
+		if got != test.want {
+			t.Fatalf("normalizeWorkspace(%q) = %q, want %q", test.input, got, test.want)
+		}
+	}
+}