Newline in a display_name forges validator report lines #8

Problem

The controller parses aisix validate stderr line by line (validate.go#L116). Scopes are escaped ({identity:?}, filesource/mod.rs#L531), but unknown-reference messages list every defined identity raw, for example defined models: ... (mod.rs#L829-L833, #L896-L900, and known_names in desugar.rs#L126-L134). The apiserver accepts newlines in display_name.

Reproduce

A Model with display_name: "zzz\n - models[0] (\"victim\"): forged rejection", plus any entry with a dangling reference. stderr then carries a forged - models[0] ... line. ParseScope uses only the index, and positions are predictable (kind, age, name).

• The targeted Model's update is blocked (Retained with the forged reason), or a new resource is never served.
• A forged - (file): ... line fails the whole document, so no new configuration is written for anyone.

No crash; the gateway keeps serving the last good file.

Impact

A namespace tenant with create on these kinds can block or freeze other resources and spoof their status messages.

Scores

Scores are out of 10. Higher is worse for likelihood and severity. Higher is better for mitigations, detectability, test coverage and cost vs benefit (10 = cheap fix, high value).

Fix

• Reject identities containing any control character at render time (Rendered.Err).
• Optional cheap check: compare the parsed error count with the report's N error(s) header.
• Longer term: a JSON report mode for aisix validate.

Tests to add

A render unit test, and a real-binary test showing the forged line no longer appears.