audit and harden workspace

all/cmd/main/main.go

@@ -3,9 +3,11 @@ package main
 import (
 	"context"
 	"flag"
+	"fmt"
 	"net/http"
 	"os"
 	"os/signal"
+	"regexp"
 	"strings"
 	"syscall"
 	"time"
@@ -18,12 +20,24 @@ import (
 
 var ServiceKey = "default"
 
+var workspacePattern = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$`)
+
+func normalizeWorkspace(value string) (string, error) {
+	value = strings.ToLower(strings.TrimSpace(value))
+	if !workspacePattern.MatchString(value) {
+		return "", fmt.Errorf("workspace must match %s", workspacePattern.String())
+	}
+	return value, nil
+}
+
 func main() {
 	workspace := flag.String("workspace", ServiceKey, "workspace used to select etc/{workspace}_{runtime}.yaml")
 	flag.Parse()
-	if value := strings.TrimSpace(*workspace); value != "" {
-		ServiceKey = value
+	value, err := normalizeWorkspace(*workspace)
+	if err != nil {
+		panic(err)
 	}
+	ServiceKey = value
 
 	config.New(ServiceKey)
 	impl.NewImpl()