Add node label validation to prevent command injection (#251)

Author: avinxshKD

mkconcore.py

@@ -200,7 +200,11 @@
             node_label_tag = data.find('y:NodeLabel')
             if node_label_tag:
                 node_label = prefixedgenode + node_label_tag.text
-                nodes_dict[node['id']] = re.sub(r'(\s+|\n)', ' ', node_label)
+                node_label = re.sub(r'(\s+|\n)', ' ', node_label)
+                if not re.match(r'^[a-zA-Z0-9_\-.:]+$', node_label):
+                    logging.error(f"node label '{node_label}' has unsupported characters")
+                    quit()
+                nodes_dict[node['id']] = node_label
                 node_id_to_label_map[node['id']] = node_label.split(':')[0]
     except (IndexError, AttributeError):
         logging.debug('A node with no valid properties encountered and ignored')