Function validate_ssh_session_response

crates/openshell-core/src/forward.rs:854–891

Validate a `CreateSshSessionResponse` before any of its fields are used to build a shell command or config file. This is a belt-and-suspenders pair to [`build_proxy_command`]: escaping alone is sufficient to prevent injection, but rejecting malformed fields at the trust boundary fails loudly before the string is assembled and catches gateway bugs or tampering early.

(
    resp: &crate::proto::CreateSshSessionResponse,
)

/// at the trust boundary fails loudly before the string is assembled and
/// catches gateway bugs or tampering early.
pub fn validate_ssh_session_response(
    resp: &crate::proto::CreateSshSessionResponse,
) -> std::result::Result<(), SshSessionResponseError> {
    validate_field(
        "sandbox_id",
        &resp.sandbox_id,
        MAX_SANDBOX_ID_LEN,
        is_sandbox_id_byte,
    )?;
    validate_field("token", &resp.token, MAX_TOKEN_LEN, is_token_byte)?;
    validate_field(
        "gateway_host",
        &resp.gateway_host,
        MAX_GATEWAY_HOST_LEN,
        is_gateway_host_byte,
    )?;
    match resp.gateway_scheme.as_str() {
        "http" | "https" => {}
        _ => return Err(SshSessionResponseError::InvalidScheme),
    }
    if resp.gateway_port == 0 || resp.gateway_port > u32::from(u16::MAX) {
        return Err(SshSessionResponseError::InvalidPort);
    }
    if !resp.host_key_fingerprint.is_empty() {
        if resp.host_key_fingerprint.len() > MAX_FINGERPRINT_LEN {
            return Err(SshSessionResponseError::TooLong {
                field: "host_key_fingerprint",
                max: MAX_FINGERPRINT_LEN,
            });
        }
        if !resp.host_key_fingerprint.bytes().all(is_fingerprint_byte) {
            return Err(SshSessionResponseError::InvalidChars {
                field: "host_key_fingerprint",
            });
        }
    }
    Ok(())
}

fn validate_field(
    name: &'static str,