Add comprehensive input validation to prevent security vulnerabilities

- Add database port validation (1-65535)
- Add S3 region validation (alphanumeric, dash, underscore only, max 50 chars)
- Add table name sanitization to prevent SQL injection (PostgreSQL identifier rules)
- Add workers count upper limit (max 1000) to prevent integer overflow
- Add comprehensive test coverage for all validation rules

Co-authored-by: kevinelliott <123112+kevinelliott@users.noreply.github.com>

Author: Copilot

cmd/config.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"fmt"
+	"regexp"
 	"time"
 )
 
@@ -36,13 +37,53 @@ type S3Config struct {
 	Region    string
 }
 
+// validPostgreSQLIdentifier checks if a string is a valid PostgreSQL identifier
+// to prevent SQL injection attacks
+var validPostgreSQLIdentifier = regexp.MustCompile(`^[a-zA-Z_][a-zA-Z0-9_]*$`)
+
+// isValidTableName validates that a table name is safe to use in SQL queries
+func isValidTableName(name string) bool {
+	// Check for empty or excessively long names
+	if name == "" || len(name) > 63 {
+		return false
+	}
+
+	// Must match PostgreSQL identifier rules
+	return validPostgreSQLIdentifier.MatchString(name)
+}
+
+// isValidRegion validates that an S3 region is reasonable
+func isValidRegion(region string) bool {
+	// Empty region is not valid (except for "auto" which is handled separately)
+	if region == "" {
+		return false
+	}
+
+	// Region should be reasonable length
+	if len(region) > 50 {
+		return false
+	}
+
+	// Region should only contain alphanumeric, dash, and underscore
+	matched, _ := regexp.MatchString(`^[a-zA-Z0-9_-]+$`, region)
+	return matched
+}
+
 func (c *Config) Validate() error {
+	// Validate database configuration
 	if c.Database.User == "" {
 		return fmt.Errorf("database user is required")
 	}
 	if c.Database.Name == "" {
 		return fmt.Errorf("database name is required")
 	}
+
+	// Validate database port
+	if c.Database.Port < 1 || c.Database.Port > 65535 {
+		return fmt.Errorf("database port must be between 1 and 65535, got %d", c.Database.Port)
+	}
+
+	// Validate S3 configuration
 	if c.S3.Endpoint == "" {
 		return fmt.Errorf("S3 endpoint is required")
 	}
@@ -55,10 +96,23 @@ func (c *Config) Validate() error {
 	if c.S3.SecretKey == "" {
 		return fmt.Errorf("S3 secret key is required")
 	}
+
+	// Validate S3 region
+	if c.S3.Region != "" && c.S3.Region != "auto" {
+		if !isValidRegion(c.S3.Region) {
+			return fmt.Errorf("S3 region contains invalid characters or is too long: %s", c.S3.Region)
+		}
+	}
+
+	// Validate and sanitize table name to prevent SQL injection
 	if c.Table == "" {
 		return fmt.Errorf("table name is required")
 	}
+	if !isValidTableName(c.Table) {
+		return fmt.Errorf("table name '%s' is invalid: must be 1-63 characters, start with a letter or underscore, and contain only letters, numbers, and underscores", c.Table)
+	}
 
+	// Validate date formats
 	if c.StartDate != "" {
 		if _, err := time.Parse("2006-01-02", c.StartDate); err != nil {
 			return fmt.Errorf("invalid start date format: %v", err)
@@ -70,9 +124,15 @@ func (c *Config) Validate() error {
 		}
 	}
 
+	// Validate workers count
 	if c.Workers < 1 {
 		return fmt.Errorf("workers must be at least 1")
 	}
+	// Prevent integer overflow and excessive resource usage
+	// More than 1000 workers is unreasonable and could cause issues
+	if c.Workers > 1000 {
+		return fmt.Errorf("workers must not exceed 1000, got %d", c.Workers)
+	}
 
 	return nil
 }