api,adaptation: more strict plugin name check.

Verify that a registered plugin name is not empty and only contains
characters from the set [a-zA-Z0-9_.+-].

Signed-off-by: Krisztian Litkey <[email protected]>

Author: klihub

pkg/adaptation/adaptation_suite_test.go

@@ -201,6 +201,19 @@ var _ = Describe("Plugin connection", func() {
 		s.Cleanup()
 	})
 
+	It("should reject plugins with an invalid name", func() {
+		var (
+			invalidPlugin = &mockPlugin{
+				name: "foo,bar",
+				idx:  "10",
+			}
+		)
+
+		s.Startup()
+
+		Expect(invalidPlugin.Start(s.dir)).ToNot(Succeed())
+	})
+
 	It("should configure the plugin", func() {
 		var (
 			plugin = s.plugins[0]

pkg/adaptation/plugin.go

@@ -435,9 +435,9 @@ func (p *plugin) qualifiedName() string {
 // RegisterPlugin handles the plugin's registration request.
 func (p *plugin) RegisterPlugin(ctx context.Context, req *RegisterPluginRequest) (*RegisterPluginResponse, error) {
 	if p.isExternal() {
-		if req.PluginName == "" {
-			p.regC <- fmt.Errorf("plugin %q registered with an empty name", p.qualifiedName())
-			return &RegisterPluginResponse{}, errors.New("invalid (empty) plugin name")
+		if err := api.CheckPluginName(req.PluginName); err != nil {
+			p.regC <- fmt.Errorf("plugin registered with an invalid name: %w", err)
+			return &RegisterPluginResponse{}, fmt.Errorf("invalid plugin name: %w", err)
 		}
 		if err := api.CheckPluginIndex(req.PluginIdx); err != nil {
 			p.regC <- fmt.Errorf("plugin %q registered with an invalid index: %w", req.PluginName, err)

pkg/api/plugin.go

@@ -17,6 +17,7 @@
 package api
 
 import (
+	"errors"
 	"fmt"
 	"strings"
 )
@@ -57,3 +58,23 @@ func CheckPluginIndex(idx string) error {
 	}
 	return nil
 }
+
+// CheckPluginName verifies that a plugin name is not empty and only contains
+// characters from the set [a-zA-Z0-9_.+-].
+func CheckPluginName(name string) error {
+	if name == "" {
+		return errors.New("invalid plugin name: name is empty")
+	}
+
+	for _, r := range name {
+		switch {
+		case 'a' <= r && r <= 'z', 'A' <= r && r <= 'Z':
+		case '0' <= r && r <= '9':
+		case r == '-', r == '_', r == '.', r == '+':
+		default:
+			return fmt.Errorf("invalid plugin name %q: contains invalid character %q", name, r)
+		}
+	}
+
+	return nil
+}