[Fix] Deployment accepts malformed domain names

deploy/ci/validate-domain-subprocess.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+# Test-only harness: sources the deployment lib and validates the domain
+# passed as $1. Invoked as an explicit positional argument to `bash` (no
+# `-c` shell string), so the caller never interpolates a path into shell
+# command text.
+
+set -euo pipefail
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+source "$script_dir/../scripts/lib.sh"
+
+validate_domain "$1"

deploy/scripts/deploy.sh

@@ -190,8 +190,9 @@ if [ "$database_mode" = "external" ] && ! env_has_key "$env_file" DATABASE_URL;
   die "--database external requires DATABASE_URL in $env_file"
 fi
 
-if [ "$manage_dns" = "true" ] && [ -z "$dns_zone" ]; then
-  die "--dns-zone is required with --manage-dns"
+if [ "$manage_dns" = "true" ]; then
+  [ -n "$dns_zone" ] || die "--dns-zone is required with --manage-dns"
+  validate_domain "$dns_zone"
 fi
 
 if [ "${#ssh_allowed_cidrs[@]}" -eq 0 ]; then

deploy/scripts/lib.sh

@@ -43,7 +43,20 @@ validate_slug() {
 }
 
 validate_domain() {
-  [[ "$1" =~ ^[A-Za-z0-9][A-Za-z0-9.-]*[A-Za-z0-9]$ ]] || die "invalid domain: $1"
+  local domain="$1"
+  local label
+  local -a labels
+
+  if [ -z "$domain" ] || [ "${#domain}" -gt 253 ] || [[ "$domain" = .* || "$domain" = *. ]]; then
+    die "invalid domain: $domain"
+  fi
+  case "$domain" in
+    *$'\n'* | *$'\r'*) die "invalid domain: $domain" ;;
+  esac
+  IFS='.' read -r -a labels <<<"$domain"
+  for label in "${labels[@]}"; do
+    [[ "$label" =~ ^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?$ ]] || die "invalid domain: $domain"
+  done
 }
 
 validate_image_part() {

package.json

@@ -32,7 +32,7 @@
     "db:reset": "pnpm db:down && docker volume rm -f roomote_pg_data roomote_redis_data roomote_minio_data && pnpm db:up",
     "db:seed": "pnpm --silent --filter @roomote/db db:seed",
     "db:seed:demo": "pnpm --silent --filter @roomote/db db:seed:demo",
-    "deployment:validate": "node deploy/ci/validate-deployment-artifacts.mjs",
+    "deployment:validate": "node --test deploy/ci/deployment-scripts.test.mjs && node deploy/ci/validate-deployment-artifacts.mjs",
     "deployment:smoke": "bash deploy/ci/deployment-smoke.sh",
     "dev": "pnpm --silent --filter @roomote/dev dev",
     "doctor": "pnpm --filter @roomote/dev run doctor",