fix(multiplayer): validate server event resource ids

server/api/events.go

@@ -11,6 +11,7 @@ import (
 	"io"
 	"net"
 	"net/http"
+	"regexp"
 	"strings"
 	"sync"
 	"time"
@@ -27,8 +28,11 @@ const (
 	webSocketMessageLimit        = 120
 	webSocketMessageWindow       = time.Minute
 	maxEventConnectionsPerPlayer = 2
+	controlPlaneResourceIDPattern = `^[A-Za-z0-9_-]{16,128}$`
 )
 
+var controlPlaneResourceIDRE = regexp.MustCompile(controlPlaneResourceIDPattern)
+
 // ControlPlaneEvent is the server-to-client envelope defined by the v1
 // WebSocket contract. PlayerID is routing metadata and is never serialized.
 type ControlPlaneEvent struct {
@@ -114,7 +118,7 @@ func (h *eventHub) publish(event ControlPlaneEvent) error {
 }
 
 func validateControlPlaneEvent(event ControlPlaneEvent) error {
-	if event.PlayerID == "" || event.ResourceID == "" || event.OccurredAt.IsZero() {
+	if event.PlayerID == "" || !controlPlaneResourceIDRE.MatchString(event.ResourceID) || event.OccurredAt.IsZero() {
 		return errors.New("invalid control-plane event envelope")
 	}
 	switch event.Event {