Potential fix for code scanning alert no. 4: Database query built from user-controlled sources

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: kehiy

internal/presentation/handler/list_handler.go

@@ -25,8 +25,8 @@ func NewListHandler(lister abstraction.Lister) *ListHandler {
 // HandleList handles GET /list/:pubKey requests.
 func (h *ListHandler) HandleList(c echo.Context) error {
 	pubKey := c.Param(presentation.PK)
-	if pubKey == "" {
-		c.Response().Header().Set(presentation.ReasonTag, "missing pubKey")
+	if pubKey == "" || !isValidPubKey(pubKey) {
+		c.Response().Header().Set(presentation.ReasonTag, "invalid or missing pubKey")
 
 		return c.NoContent(http.StatusBadRequest)
 	}
@@ -71,3 +71,9 @@ func parseTimeQueryParam(c echo.Context, paramName string) (*time.Time, error) {
 
 	return &t, nil
 }
+
+// isValidPubKey validates the pubKey to ensure it is alphanumeric and meets expected length constraints.
+func isValidPubKey(pubKey string) bool {
+	const pubKeyPattern = `^[a-zA-Z0-9]{1,64}$` // Example: Adjust length as needed
+	return regexp.MustCompile(pubKeyPattern).MatchString(pubKey)
+}