security: fix command injection vulnerability in container_dispatcher.py

- Add input validation for environment variables (SEMGREP-1211)
- Validate Python version format (3.10-3.14)
- Validate container registry format
- Validate image name format
- Validate semantic version format
- Prevents command injection via malicious environment variables

Fixes: python.lang.security.audit.dangerous-subprocess-use-tainted-env-args

Author: fgogolli

dev-tools/container/container_dispatcher.py

@@ -2,10 +2,39 @@
 """Container management dispatcher for the Open Resource Broker."""
 
 import os
+import re
 import subprocess
 import sys
 
 
+def validate_python_version(version):
+    """Validate Python version format (e.g., 3.10, 3.11, 3.12, 3.13, 3.14)."""
+    if not re.match(r'^3\.(1[0-4]|[0-9])$', version):
+        raise ValueError(f"Invalid Python version: {version}")
+    return version
+
+
+def validate_registry(registry):
+    """Validate container registry format."""
+    if not re.match(r'^[a-zA-Z0-9.-]+(?:\:[0-9]+)?$', registry):
+        raise ValueError(f"Invalid registry: {registry}")
+    return registry
+
+
+def validate_image_name(name):
+    """Validate container image name."""
+    if not re.match(r'^[a-z0-9-]+$', name):
+        raise ValueError(f"Invalid image name: {name}")
+    return name
+
+
+def validate_version(version):
+    """Validate semantic version format."""
+    if not re.match(r'^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9-]+)?$', version):
+        raise ValueError(f"Invalid version: {version}")
+    return version
+
+
 def parse_args(args):
     """Parse command line arguments."""
     return {
@@ -19,9 +48,9 @@ def parse_args(args):
 
 def handle_version():
     """Handle version command."""
-    registry = os.getenv("CONTAINER_REGISTRY", "localhost")
-    image = os.getenv("CONTAINER_IMAGE", "open-resource-broker")
-    version_val = os.getenv("VERSION", "0.1.0-dev")
+    registry = validate_registry(os.getenv("CONTAINER_REGISTRY", "localhost"))
+    image = validate_image_name(os.getenv("CONTAINER_IMAGE", "open-resource-broker"))
+    version_val = validate_version(os.getenv("VERSION", "0.1.0-dev"))
     print(f"Container Registry: {registry}")
     print(f"Container Image: {image}")
     print(f"Container Version: {version_val}")
@@ -39,10 +68,10 @@ def handle_run():
 
 def handle_single():
     """Handle single platform build."""
-    python_version = os.getenv("PYTHON_VERSION", "3.12")
-    registry = os.getenv("CONTAINER_REGISTRY", "localhost")
-    image = os.getenv("CONTAINER_IMAGE", "open-resource-broker")
-    version_val = os.getenv("VERSION", "0.1.0-dev")
+    python_version = validate_python_version(os.getenv("PYTHON_VERSION", "3.12"))
+    registry = validate_registry(os.getenv("CONTAINER_REGISTRY", "localhost"))
+    image = validate_image_name(os.getenv("CONTAINER_IMAGE", "open-resource-broker"))
+    version_val = validate_version(os.getenv("VERSION", "0.1.0-dev"))
 
     cmd = [
         "docker",