disinto-admin/disinto
1
0
Fork 0
Code Issues 24 Pull requests 7 Projects Releases Packages Wiki Activity Actions

fix: edge-control: reserved name list and stricter DNS-label validation in register (#1093)

Browse source 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude 2026-04-20 18:49:49 +00:00
parent 65df00ea6a
commit 4187756059
1 changed files with 15 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

17
tools/edge-control/register.sh
View file

@ -25,6 +25,9 @@ source "${SCRIPT_DIR}/lib/authorized_keys.sh"
# Domain suffix # Domain suffix
DOMAIN_SUFFIX="${DOMAIN_SUFFIX:-disinto.ai}" DOMAIN_SUFFIX="${DOMAIN_SUFFIX:-disinto.ai}"
# Reserved project names — operator-adjacent, internal roles, and subdomain-mode prefixes
RESERVED_NAMES=(www api admin root mail chat forge ci edge caddy disinto register tunnel)
# Print usage # Print usage
usage() { usage() {
cat <<EOF cat <<EOF
@ -47,12 +50,22 @@ do_register() {
local project="$1" local project="$1"
local pubkey="$2" local pubkey="$2"
# Validate project name (alphanumeric, hyphens, underscores) # Validate project name — strict DNS label: lowercase alphanumeric, inner hyphens,
if ! [[ "$project" =~ ^[a-zA-Z0-9_-]+$ ]]; then # 3-63 chars, no leading/trailing hyphen, no underscore (RFC 1035)
if ! [[ "$project" =~ ^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$ ]]; then
echo '{"error":"invalid project name"}' echo '{"error":"invalid project name"}'
exit 1 exit 1
fi fi
# Check against reserved names
local reserved
for reserved in "${RESERVED_NAMES[@]}"; do
if [[ "$project" = "$reserved" ]]; then
echo '{"error":"name reserved"}'
exit 1
fi
done
# Extract key type and key from pubkey (format: "ssh-ed25519 AAAAC3...") # Extract key type and key from pubkey (format: "ssh-ed25519 AAAAC3...")
local key_type key local key_type key
key_type=$(echo "$pubkey" | awk '{print $1}') key_type=$(echo "$pubkey" | awk '{print $1}')