Sanitize contract name when calling stellar contract init --name.

[fnando]

What

Sanitize contract name when calling stellar contract init --name.

$ target/debug/stellar contract init /tmp/mycontract --name ../invalid
error: invalid value '../invalid' for '--name <NAME>': Invalid name: ../invalid
 only alphanumeric characters, underscores (_), and hyphens (-) are allowed.

For more information, try '--help'.

Why

https://hackerone.com/reports/3587907

Known limitations

N/A

[Copilot]

Pull request overview

This PR tightens input validation for stellar contract init --name by reusing the existing “safe name” validation logic, preventing path traversal and other invalid contract names from being used as filesystem path components.

Changes:

• Introduces a ContractName newtype that validates names via the existing validate_name rules.
• Updates contract init to accept --name as ContractName (instead of String) and uses it when creating the contract directory and templating Cargo.toml.
• Adds an integration test asserting contract init --name ../evil fails with an “Invalid name” error.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
cmd/soroban-cli/src/config/address.rs	Adds ContractName and unit tests to validate allowed/rejected inputs.
cmd/soroban-cli/src/commands/contract/init.rs	Switches --name parsing to ContractName and uses it safely for directory creation and templating.
cmd/crates/soroban-test/tests/it/config.rs	Adds an integration test ensuring contract init rejects path traversal in --name.