Sanitize Bundle Name - Githubissues

defenseunicorns / uds-cli

GNU Affero General Public License v3.0

26 stars 11 forks source link

Sanitize Bundle Name #886

Open TristanHoladay opened 2 months ago

TristanHoladay commented 2 months ago

Based on a comment from @catsby (https://github.com/defenseunicorns/uds-cli/pull/882#discussion_r1735361049) we should be doing some kind of sanitizing on bundle names.

[ ] ensure bundle name is sanitized
[ ] look into if there are other pieces of metadata getting used in potentially compromising ways and should be sanitized

catsby commented 1 month ago

@TristanHoladay do you think we want to reject bundle names with "bad" characters ([,*,\, etc) and error here, or just remove them... the difference being do we silently ignore them or fail with validation errors

TristanHoladay commented 1 month ago

@catsby i think we should reject them with validation errors. spoke with @UncleGedd synchronously, and he agreed.