add more sanity checks to api

backend/Cargo.lock

@@ -4781,6 +4781,7 @@ dependencies = [
  "mime_guess",
  "prometheus",
  "rand 0.8.5",
+ "regex",
  "reqwest",
  "retainer",
  "rust-embed",

backend/windmill-api/Cargo.toml

@@ -69,3 +69,4 @@ async-stripe = { workspace = true, optional = true }
 lazy_static.workspace = true
 prometheus.workspace = true
 async_zip.workspace = true
+regex.workspace = true

backend/windmill-api/src/apps.rs

@@ -320,6 +320,10 @@ async fn create_app(
     app.policy.on_behalf_of = Some(username_to_permissioned_as(&authed.username));
     app.policy.on_behalf_of_email = Some(authed.email);
 
+    if &app.path == "" {
+        return Err(Error::BadRequest("App path cannot be empty".to_string()));
+    }
+
     let id = sqlx::query_scalar!(
         "INSERT INTO app
             (workspace_id, path, summary, policy, versions)

backend/windmill-api/src/folders.rs

@@ -16,6 +16,8 @@ use axum::{
     routing::{delete, get, post},
     Json, Router,
 };
+use lazy_static::lazy_static;
+use regex::Regex;
 use windmill_audit::{audit_log, ActionKind};
 use windmill_common::{
     error::{self, to_anyhow, Error, JsonResult, Result},
@@ -136,6 +138,10 @@ async fn check_name_conflict<'c>(
     return Ok(());
 }
 
+lazy_static! {
+    static ref VALID_FOLDER_NAME: Regex = Regex::new(r#"^[a-zA-Z_0-9]+$"#).unwrap();
+}
+
 async fn create_folder(
     authed: Authed,
     Extension(user_db): Extension<UserDB>,
@@ -145,6 +151,12 @@ async fn create_folder(
 ) -> Result<String> {
     let mut tx = user_db.begin(&authed).await?;
 
+    if !VALID_FOLDER_NAME.is_match(&ng.name) {
+        return Err(windmill_common::error::Error::BadRequest(format!(
+            "Folder name can only contain alphanumeric characters, underscores"
+        )));
+    }
+
     check_name_conflict(&mut tx, &w_id, &ng.name).await?;
     let owner = username_to_permissioned_as(&authed.username);
     let owners = &ng.owners.unwrap_or(vec![owner.clone()]);

backend/windmill-api/src/workspaces.rs

@@ -16,7 +16,7 @@ use crate::{
     db::{UserDB, DB},
     folders::Folder,
     resources::{Resource, ResourceType},
-    users::{Authed, WorkspaceInvite, NEW_USER_WEBHOOK},
+    users::{Authed, WorkspaceInvite, NEW_USER_WEBHOOK, VALID_USERNAME},
     utils::require_super_admin,
     HTTP_CLIENT,
 };
@@ -986,6 +986,11 @@ async fn add_user(
     require_admin(is_admin, &username)?;
 
     let mut tx = db.begin().await?;
+    if !VALID_USERNAME.is_match(&nu.username) {
+        return Err(windmill_common::error::Error::BadRequest(format!(
+            "Usermame can only contain alphanumeric characters and underscores"
+        )));
+    }
 
     sqlx::query!(
         "INSERT INTO usr