refactor: fixing version string problem

[ngvanthanggit]

Description

In this PR, I fixed the problem of being unable to upload the plugin due to the restriction of the plugin name, author, and version.

Related Issue

Fixes #2162

Changes Made

• Added '.' character to the safe list

Checklist

Please ensure the following before submitting your PR:

• I have reviewed the project's contribution guidelines.
• I have written unit tests for the changes (if applicable).
• I have updated the documentation (if applicable).
• I have tested the changes locally and ensured they work as expected.
• My code follows the project's coding standards.

Screenshots or Logs (if applicable)

Screen.Recording.2025-11-02.at.20.52.21.mov

Additional Notes

[ngvanthanggit]

@MAVRICK-1 please review!

[Copilot]

Pull Request Overview

This PR fixes a typo in the sanitize function name and enhances input sanitization and error logging for plugin handling.

• Fixed spelling of santinize to sanitize throughout the codebase
• Updated sanitize function to trim whitespace and convert to lowercase
• Added error logging for plugin handler execution failures
• Extended the regex pattern to allow dots in plugin names, authors, and versions

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Adding dot (.) to the allowed characters creates a security risk. The dot has special meaning in regular expressions and file paths. In file paths, dots can be used for directory traversal (e.g., ..). The BuildPluginKey function constructs file paths (see pluginDir := filepath.Join(pluginDirLoad, pluginKey) at line 433 of api/plugins.go), making this vulnerable to path traversal attacks. Consider escaping dots or only allowing them in specific positions (e.g., for semantic versioning like 1.0.0).

Suggested change

	safePattern = regexp.MustCompile(`^[a-zA-Z0-9_.-]+$`)
	safePattern = regexp.MustCompile(`^[a-zA-Z0-9_-]+$`)

[MAVRICK-1]

/approve /lgtm

[ngvanthanggit]

@MAVRICK-1 @gaurab-khanal, Currently, it's pluginName~authorName~version. I suggested this and implemented this in our code. However, it's up to you how you want to make the naming convention. I did consider and tried to find the best way to deliver it.

If you think it's not a good implementation, um, please give some suggestions!

The PR I made this convention: PR #2034

[vedansh-5]

/ok-to-test

[ghanshyam2005singh]

/approve

[kubestellar-prow]

LGTM label has been added.

Details

Git tree hash: 7eee7b51b6bbc0e2d80a5217457cd5c5ee72d327

[btwshivam]

/approve

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: btwshivam, ghanshyam2005singh, MAVRICK-1

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [MAVRICK-1,btwshivam]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment