feat: add regex assertion for station_id (#533)

* Added regex assertion for station_id

* cargo fmt fix

* Move station_id constraint assertion to run_js_module

* Move regex dependency to runtime

* Fix for lack of anyhow import in runtime.rs

* Switch back to anyhow usage directly

* One more try...

* Extract station ID validation helper function with lazy initialization

---------

Co-authored-by: Miroslav Bajtoš <oss@bajtos.net>

runtime/Cargo.toml

@@ -25,6 +25,7 @@ lassie = "0.9.0"
 # lassie = { git = "https://github.com/filecoin-station/rusty-lassie.git" }
 log.workspace = true
 once_cell = "1.19.0"
+regex = "1.10.4"
 serde.workspace = true
 serde_repr.workspace = true
 termcolor = "1.4.1"
@@ -36,7 +37,6 @@ assert_fs = { workspace = true }
 console_static_text = "0.8.1"
 env_logger.workspace = true
 pretty_assertions = { workspace = true }
-regex = "1.10.4"
 
 [lints]
 workspace = true

runtime/runtime.rs

@@ -7,6 +7,8 @@ use deno_core::{located_script_name, serde_json, JsRuntime, ModuleSpecifier, Run
 
 use deno_web::BlobStore;
 
+use {once_cell::sync::Lazy, regex::Regex};
+
 use crate::module_loader::ZinniaModuleLoader;
 use crate::{colors, Reporter};
 
@@ -15,7 +17,7 @@ use crate::ext::ZinniaPermissions;
 use zinnia_libp2p;
 
 pub type AnyError = deno_core::anyhow::Error;
-use deno_core::anyhow::Result;
+use deno_core::anyhow::{anyhow, Result};
 
 /// Common bootstrap options for MainWorker & WebWorker
 #[derive(Clone)]
@@ -96,6 +98,10 @@ pub async fn run_js_module(
     module_specifier: &ModuleSpecifier,
     bootstrap_options: &BootstrapOptions,
 ) -> Result<(), AnyError> {
+    if !validate_station_id(&bootstrap_options.station_id) {
+        return Err(anyhow!("Invalid station_id format"));
+    }
+
     let blob_store = Arc::new(BlobStore::default());
     let reporter = Rc::clone(&bootstrap_options.reporter);
 
@@ -165,3 +171,8 @@ pub fn lassie_config() -> lassie::DaemonConfig {
         ..Default::default()
     }
 }
+
+fn validate_station_id(station_id: &str) -> bool {
+    static RE: Lazy<Regex> = Lazy::new(|| Regex::new(r"^[0-9a-fA-F]{88}$").unwrap());
+    RE.is_match(station_id)
+}