TagResource does not validate tag key and value characters #444

What ExtendDB does

handle_tag_resource in crates/engine/src/tagging.rs checks that the resource ARN is non-empty and well-formed through validate_resource_arn, then stores the tags. It applies no character or length validation to the tag keys or values.

What DynamoDB does

Measured on 2026-10-22 with TagResource on a table:

• A key with ! or # returns ValidationException The Tag Key provided is invalid, Key: <key>. A value with ! returns The Tag Value provided is invalid, Value: <value>.
• A key of 128 characters is accepted and one of 129 is rejected with the same key message. A value of 256 characters is accepted and one of 257 is rejected with the value message.
• A key starting with aws: returns ValidationException Tag Key cannot be prefixed with aws:, Key: <key>.
• A key and value using letters, digits, spaces and _ . : / = + - @ are accepted.

Effect

ExtendDB stores tag keys and values that the service rejects at write. A tag that cannot exist on the service can be created on ExtendDB, so a policy that conditions on such a tag behaves differently between the two.

Suggested fix

Validate tag keys and values in handle_tag_resource with the rules and messages above. Non-ASCII letters were not measured, so the allowed set for them still needs a measurement.