Potential future shenanigans with service attribute

[zardus]

This:

dojo/dojo_plugin/api/v1/workspace.py

Line 20 in f75976d

service = request.args.get("service")

... leading to

dojo/dojo_plugin/api/v1/workspace.py

Line 62 in f75976d

if start_on_demand_service(user, service) is False:

... leading to

dojo/dojo_plugin/utils/workspace.py

Line 13 in f75976d

f"/run/current-system/sw/bin/dojo-{service_name}",

... only saved by

dojo/dojo_plugin/utils/workspace.py

Line 9 in f75976d

if service_name not in on_demand_services:

Future refactors can easily turn this into a problem. We need to sanitize the service attribute. The most complex part of that is

dojo/dojo_plugin/pages/workspace.py

Line 64 in f75976d

service_name, user_id, access_code = service.split("~", 2)

and the question of what chars are valid in an access code. It's that, plus [A-Za-z0-9~]