Summary
Pod names and labels are built by interpolating user_id, team, and app_slug without normalizing them to DNS-1123 (lowercase alphanumeric + -, ≤63 chars):
landing/app/pods.py:166 — name = f"build-{user_id}-{short}"; label sus.dev/user: user_id (line 73)landing/app/run_pods.py:134 — name = f"run-{team}-{app_slug}-{short}"
team and app_slug flow from URL path segments in the build/run routes, which accept arbitrary values. Uppercase letters, underscores, or over-long values make create_namespaced_pod fail with a 422, breaking the build/run flow. (New apps generate safe slugs in main.py:155-156, but the routes don't re-validate incoming path segments.)
Suggested fix
Normalize/validate team, app_slug, and user_id to DNS-1123 before using them in pod names and labels — lowercase, replace invalid chars with -, collapse/trim, and truncate — or reject invalid path segments at the route with a clear 400.
Found during a repo audit.
Summary
Pod names and labels are built by interpolating
user_id,team, andapp_slugwithout normalizing them to DNS-1123 (lowercase alphanumeric +-, ≤63 chars):landing/app/pods.py:166—name = f"build-{user_id}-{short}"; labelsus.dev/user: user_id(line 73)landing/app/run_pods.py:134—name = f"run-{team}-{app_slug}-{short}"teamandapp_slugflow from URL path segments in the build/run routes, which accept arbitrary values. Uppercase letters, underscores, or over-long values makecreate_namespaced_podfail with a 422, breaking the build/run flow. (New apps generate safe slugs inmain.py:155-156, but the routes don't re-validate incoming path segments.)Suggested fix
Normalize/validate
team,app_slug, anduser_idto DNS-1123 before using them in pod names and labels — lowercase, replace invalid chars with-, collapse/trim, and truncate — or reject invalid path segments at the route with a clear 400.Found during a repo audit.