validate cid during strategy import

api/strategies.go

@@ -10,6 +10,7 @@ import (
 	"strconv"
 
 	"github.com/ethereum/go-ethereum/common"
+	gocid "github.com/ipfs/go-cid"
 	queries "github.com/vocdoni/census3/db/sqlc"
 	"github.com/vocdoni/census3/lexer"
 	"github.com/vocdoni/census3/roundedcensus"
@@ -286,6 +287,12 @@ func (capi *census3API) launchStrategyImport(msg *api.APIdata, ctx *httprouter.H
 	if ipfsCID == "" {
 		return ErrMalformedStrategy.With("no IPFS cID provided")
 	}
+	// check if the cID is valid
+	if cid, err := gocid.Decode(ipfsCID); err != nil {
+		return ErrMalformedStrategy.WithErr(err)
+	} else {
+		ipfsCID = cid.String()
+	}
 	// import the strategy from IPFS in background generating a queueID
 	queueID := capi.queue.Enqueue()
 	go func() {

go.mod

@@ -9,6 +9,7 @@ require (
 	github.com/frankban/quicktest v1.14.6
 	github.com/google/uuid v1.4.0
 	github.com/hashicorp/golang-lru/v2 v2.0.7
+	github.com/ipfs/go-cid v0.4.1
 	github.com/mattn/go-sqlite3 v1.14.18
 	github.com/pressly/goose/v3 v3.10.0
 	github.com/spf13/pflag v1.0.5
@@ -109,7 +110,6 @@ require (
 	github.com/ipfs/go-bitfield v1.1.0 // indirect
 	github.com/ipfs/go-block-format v0.2.0 // indirect
 	github.com/ipfs/go-blockservice v0.5.1 // indirect
-	github.com/ipfs/go-cid v0.4.1 // indirect
 	github.com/ipfs/go-cidutil v0.1.0 // indirect
 	github.com/ipfs/go-datastore v0.6.0 // indirect
 	github.com/ipfs/go-ds-badger v0.3.0 // indirect