Validate semver string returned by vsps.

Author: jholdstock

go.mod

@@ -5,6 +5,7 @@ go 1.25.0
 require (
 	github.com/decred/vspd/types/v3 v3.0.0
 	github.com/gorilla/handlers v1.5.2
+	golang.org/x/mod v0.37.0
 )
 
 require github.com/felixge/httpsnoop v1.1.0 // indirect

go.sum

@@ -4,3 +4,5 @@ github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeO
 github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
 github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
 github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=

service.go

@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"github.com/decred/vspd/types/v3"
+	"golang.org/x/mod/semver"
 )
 
 // Vsp contains information about a single Voting Service Provider. Includes
@@ -209,6 +210,11 @@ func (s *Service) vspStats(url string, vsp Vsp) error {
 		return fmt.Errorf("%v: unmarshal failed: %w", infoURL, err)
 	}
 
+	// semver library expects the "v" prefix but vspd does not return it.
+	if !semver.IsValid("v" + info.VspdVersion) {
+		return fmt.Errorf("%v: version not valid (%q)", infoURL, info.VspdVersion)
+	}
+
 	vsp.APIVersions = info.APIVersions
 	vsp.FeePercentage = info.FeePercentage
 	vsp.Closed = info.VspClosed