disallow path navigation and newlines in urls #50
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Adding checks to `Endpoint` urls to disallow: - path navigation. This would prevent API calls like `GitForge.get_repo(forge, "JuliaLang", "../octocat/Hello-World")` from succeeding. Helps avoid possible security loopholes. - newlines. This would prevent possible security loopholes using HTTP protocol. Also added some tests.
DilumAluthge
approved these changes
Jun 15, 2025
Member
DilumAluthge
left a comment
DilumAluthge
left a comment
There was a problem hiding this comment.
I think this is fine for now. We can defer the decision about disallowing all whitespace characters to a later time.
Can you fix the typo on line 194 of src/forge.jl? After that, I think this is good to merge.
Co-authored-by: Dilum Aluthge <[email protected]>
Member
Author
|
Thanks. Typo is fixed. I have also added the change to disallow whitespace. Happy to roll it back if you think otherwise, but it does seem safer to go with that restrictiction now and we can always relax it if we find a genuine case for it later. |
nkottary
approved these changes
Jun 16, 2025
This was referenced Jun 21, 2025
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adding checks to
Endpointurls to disallow:GitForge.get_repo(forge, "JuliaLang", "../octocat/Hello-World")from succeeding. Helps avoid possible security loopholes.Also added some tests.