security: GHSA-364q-w7vh-vhpc (HIGH) Unsafe parsing of UniqueTrackingId can be used to write files

service/internal/executor/executor.go

@@ -20,6 +20,7 @@ import (
 	"os"
 	"os/exec"
 	"path"
+	"regexp"
 	"strings"
 	"sync"
 	"time"
@@ -30,6 +31,14 @@ const (
 	MaxTriggerDepth            = 10
 )
 
+var validTrackingIDPattern = regexp.MustCompile(`^[a-fA-F0-9\-]+$`)
+
+func isValidTrackingID(id string) bool {
+	const MaxTrackingIDLength = 36
+
+	return id != "" && len(id) <= MaxTrackingIDLength && validTrackingIDPattern.MatchString(id)
+}
+
 var (
 	metricActionsRequested = promauto.NewCounter(prometheus.CounterOpts{
 		Name: "olivetin_actions_requested_count",
@@ -506,8 +515,7 @@ func (e *Executor) ExecRequest(req *ExecutionRequest) (*sync.WaitGroup, string)
 	}
 
 	_, isDuplicate := e.GetLog(req.TrackingID)
-
-	if isDuplicate || req.TrackingID == "" {
+	if isDuplicate || !isValidTrackingID(req.TrackingID) {
 		req.TrackingID = uuid.NewString()
 	}