[SECURITY] Weak repo/branch input validation allows malformed URLs in apc install

[FZ2000]

Severity: P2

Summary

The apc install command validates the repo argument only by checking for a / character and that it doesn't start with http. This allows malformed or adversarial inputs to be interpolated directly into GitHub API URLs without sanitization.

Affected Code

src/install.py — the validation:

if "/" not in repo or repo.startswith("http"):
    raise click.UsageError(...)

src/skills.py — URL templates:

_GITHUB_TREE_API = "https://api.github.com/repos/{repo}/git/trees/{branch}?recursive=1"
_GITHUB_RAW = "https://raw.githubusercontent.com/{repo}/{branch}/skills/{skill}/SKILL.md"

Problematic Inputs That Pass Validation

• ../../../evil@host.com → URL: https://api.github.com/repos/../../../evil@host.com/git/trees/main
• owner/repo\n → newline injection into HTTP request
• owner/repo?extra=1 → query string injection
• owner/repo#fragment → URL fragment smuggling
• a/b/c → malformed repo path (not caught)
• The --branch flag has no validation at all

Impact

• URL manipulation via path traversal sequences
• Newline injection into HTTP headers (CWE-93) if underlying transport interpolates raw strings
• Query string smuggling alters the GitHub API request

Recommended Fix

Validate both repo and branch with strict regex before URL construction:

import re
_REPO_SAFE = re.compile(r'^[A-Za-z0-9][A-Za-z0-9._-]*/[A-Za-z0-9][A-Za-z0-9._-]*$')
_BRANCH_SAFE = re.compile(r'^[A-Za-z0-9][A-Za-z0-9._/\-]{0,99}$')

if not _REPO_SAFE.match(repo):
    raise click.UsageError('REPO must be owner/repo format with safe characters only')
if not _BRANCH_SAFE.match(branch):
    raise click.UsageError('Branch name contains invalid characters')

References

• CWE-20: Improper Input Validation
• CWE-93: Improper Neutralization of CRLF Sequences