Harden workflow-name and owner-label validation against injection

[anirudhwarrier]

What

Hardens validation of two user-supplied identifiers — the owner address label
and the workflow name — that flow into string-templated YAML, file paths, and
copy-pasteable shell hints.

Ticket: DEVSVCS-5077

Why

--owner-label had no effective validation. validate:"omitempty" on a
plain string is a no-op, so the flag accepted arbitrary bytes — quotes,
newlines, shell metacharacters — on both cre account link-key and
cre workflow deploy. The value is sent to the backend, echoed to the
terminal, and exported via telemetry. There was a standing
// TODO: Add validation for WorkflowOwnerLabel on the field.

The interactive prompt bypassed validation entirely. Execute runs after
ValidateInputs, so a label typed at the ui.Input prompt never reached the
validator at all — only flag-supplied values were ever checked, and those
weren't checked either per the above.

Workflow names were already constrained, but not everywhere. The regex
^[a-zA-Z0-9_-]+$ is tight, but only deploy, pause, delete and
activate carried the workflow_name tag. simulate was required only,
hash had no validate tags, get checked emptiness, and the value read from
workflow.yaml was never validated at load.

Remote template manifests were trusted. cre init uses a template's
declared dir as the workflow name. That value is fetched from a remote repo
and was never validated, yet it becomes a path segment during scaffolding and
is substituted into workflow.yaml.

The sink that makes this exploitable is GenerateFileFromTemplate: rendering
is a naive strings.NewReplacer, not text/template, and the target is a
double-quoted YAML scalar (workflow-name: "{{WorkflowName}}-staging"). A
value containing " or a newline escapes the scalar and injects YAML keys.

Changes

• New owner_label validator (internal/validation/workflow.go):
  ^[a-zA-Z0-9][a-zA-Z0-9 ._-]*$, max 64. Human-readable — spaces and dots
  allowed — but no quotes, backticks, $, ;, |, /, parens, control
  characters or non-ASCII. Must start alphanumeric, so a label can never be
  read as a flag or carry leading whitespace. Mirrors the existing
  IsValidWorkflowName / isWorkflowName pair.
• Applied on both entry points: link_key.Inputs and deploy.Inputs, with
  cli:"--owner-label" so errors name the flag. Flag reads are trimmed.
• Prompt bypass closed: the ui.Input call validates inline, and the
  result is re-checked after the prompt returns.
• Workflow name validated at settings load — every consumer inherits the
  check, including hash and get. simulate's tag tightened to
  required,workflow_name.
• Template manifest dirs validated in cre init, before the project
  directory is created and before scaffolding, so a bad manifest writes
  nothing.

Workflow names keep ^[a-zA-Z0-9_-]+$ — the charset was already correct; only
enforcement was missing.

Compatibility

Settings-load validation is enforced only when the value is non-empty, so
commands that run without a workflow.yaml are unaffected. Practical risk is
low: any name that has ever been deployed already passed the same regex via
deploy's validator. Existing e2e fixtures (owner-label-1,
test-owner-label) pass the new label regex unchanged.

Testing

• go build ./... and go vet ./... clean.
• New table-driven tests for IsValidOwnerLabel and the owner_label tag
  covering quotes, command substitution, newlines, path traversal, ANSI
  escapes, non-ASCII and length bounds.
• Real ValidateInputs tests for link_key (the two existing tests were
  tautological — they re-implemented the guard in the assertion).
• Settings-load tests: an injected name fails to load; valid, empty and absent
  names still load.
• creinit test asserting a malicious template dir is rejected and the temp
  dir is left completely empty. Verified non-vacuous: with the guard disabled
  all 7 cases fail.
• Full suite passes

Note for reviewers

This branch was rebased onto #555, which independently added ui.WithValidate
(identical signature — my duplicate was dropped) and an email-derived default
owner label. Combining the two surfaced a bug neither has alone: an email local
part may contain characters a label may not (first+tag@…), so pre-filling the
prompt with an invalid default would block submission. defaultOwnerLabel now
returns "" when the derived value fails validation. Sanitizing the default
instead of dropping it would also be reasonable.

[Copilot]

Pull request overview

This pull request hardens validation for user-supplied identifiers (owner address label and workflow name) that flow into YAML templating, filesystem paths, and CLI output, reducing injection risk across multiple commands and settings-loading paths.

Changes:

• Adds an owner_label validator (regex + length) and applies it to link-key and workflow deploy, including trimming flag inputs and closing the prompt-validation bypass.
• Ensures workflow-name validation is consistently enforced by validating on settings load and tightening simulate’s input tag.
• Validates remote template manifest workflow directories in cre init before any filesystem writes, with tests.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
internal/validation/workflow.go	Adds owner-label regex/length validation and validator hook.
internal/validation/workflow_test.go	Adds table-driven tests for IsValidOwnerLabel and tag behavior.
internal/validation/validation.go	Registers owner_label validator and adds translated error message.
internal/settings/workflow_settings.go	Validates workflow name during workflow.yaml settings load.
internal/settings/workflow_settings_test.go	Adds coverage for settings-load workflow-name validation.
cmd/workflow/simulate/simulate.go	Tightens simulate’s workflow-name validation tag.
cmd/workflow/deploy/deploy.go	Applies owner_label tag and trims --owner-label input.
cmd/workflow/deploy/deploy_test.go	Adds deploy validation test cases for malicious owner labels.
cmd/creinit/creinit.go	Validates template workflow dirs from remote manifests before scaffolding.
cmd/creinit/creinit_test.go	Tests that malicious template dirs are rejected and write nothing.
cmd/account/link_key/link_key.go	Applies owner_label validation, trims flag input, validates prompt input, and drops invalid email-derived defaults.
cmd/account/link_key/link_key_test.go	Adds real ValidateInputs tests for owner-label validation behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.