[backend] Fix Regular expression injection

openbas-api/src/main/java/io/openbas/rest/challenge/ChallengeApi.java

@@ -17,6 +17,7 @@
 import io.openbas.rest.challenge.response.ChallengeResult;
 import io.openbas.rest.challenge.response.ChallengesReader;
 import io.openbas.rest.exception.ElementNotFoundException;
+import io.openbas.rest.exception.InputValidationException;
 import io.openbas.rest.helper.RestBehavior;
 import io.openbas.service.ChallengeService;
 import jakarta.transaction.Transactional;
@@ -133,7 +134,9 @@
 
   @PostMapping("/api/challenges/{challengeId}/try")
   public ChallengeResult tryChallenge(
-      @PathVariable String challengeId, @Valid @RequestBody ChallengeTryInput input) {
+      @PathVariable String challengeId, @Valid @RequestBody ChallengeTryInput input)
+      throws InputValidationException {
+    validateUUID(challengeId);
     return challengeService.tryChallenge(challengeId, input);
   }
 
@@ -143,7 +146,11 @@
       @PathVariable String exerciseId,
       @PathVariable String challengeId,
       @Valid @RequestBody ChallengeTryInput input,
-      @RequestParam Optional<String> userId) {
+      @RequestParam Optional<String> userId)
+      throws InputValidationException {
+    validateUUID(exerciseId);
+    validateUUID(challengeId);
+
     final User user = impersonateUser(userRepository, userId);
     if (user.getId().equals(ANONYMOUS)) {
       throw new UnsupportedOperationException("User must be logged or dynamic player is required");

openbas-api/src/main/java/io/openbas/rest/helper/RestBehavior.java

@@ -206,4 +206,12 @@
       }
     }
   }
+
+  protected void validateUUID(final String id) throws InputValidationException {
+    try {
+      UUID.fromString(id);
+    } catch (IllegalArgumentException e) {
+      throw new InputValidationException("id", "The ID is not a valid UUID: " + id);
+    }
+  }
 }