[ehl-jf]

• The pull request is targeting the main branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• All integration tests have passed locally as they cannot be automated yet.
• All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

---

What

Worker keys can no longer change which Platform endpoint a jf worker command calls.

• common.CallWorkerAPI, which builds every worker API URL, escapes each path element with url.PathEscape and rejects . / .. elements before sending anything. A key ../x?y now reaches /worker/api/v1/workers/..%2Fx%3Fy.
• New common.ValidateWorkerKey applies the Workers service rule (platform-extension workerValidator.service.ts, assertWorkerKeyIsValid): 2 to 40 chars, starts with a letter, ^[A-Za-z][A-Za-z0-9_\\-]+$, with the same messages. It runs on:
  • the manifest name (ValidateManifest), which covers deploy, test-run, add-secret, add-property and edit-schedule;
  • a key given as a command argument (ExtractProjectAndKeyFromCommandContext), which covers undeploy, execute and show-execution-history.
• A valid key argument still works next to a manifest whose name is invalid, and an empty key argument still falls back to the manifest name.

Why

The worker key, taken from manifest.json or the command line, was joined into the request URL unescaped. /, .., ? and # in a key could send the user's bearer token to another path on the Platform host or tamper with the query string.

Behaviour change

Keys the server would never accept are now rejected by the CLI before any request, e.g. invalid worker key 'my.worker'. Every key the server accepts keeps working.

Tests

• TestValidateWorkerKey: length bounds, first letter, allowed characters, trailing newline.
• TestCallWorkerAPI_PathEscaping: checks the raw request line on an httptest server, including the ..%2Fx%3Fy case; . / .. send no request.
• New cases in TestManifest_Validate, Test_extractProjectAndKeyFromCommandContext and TestRemoveCommand.
• Manual QA on a live JPD with the plugin build:
  • 14 invalid keys rejected on every command, both as an argument and as the manifest name, with no request sent;
  • escaping checked on the wire through a logging proxy and a local sink;
  • keys at the 2 and 40 character limits deploy, execute and undeploy;
  • regression of the other commands, with and without --project-key.