Skip to content

[WIP] Fix REST API path injection in pkg/cli/outcome_eval.go #50909

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 2 commits into from
Aug 6, 2026
+12 −2
Merged

[WIP] Fix REST API path injection in pkg/cli/outcome_eval.go #50909

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2a1b1ed
Initial plan
Copilot Aug 6, 2026
ecdd2fa
fix: URL-path-escape endpoint segments in ghAPIGet and ghAPIGetArray
Copilot Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions pkg/cli/outcome_eval.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,14 +248,24 @@ func validateAPIEndpoint(endpoint string) error {
return nil
}

// escapeEndpoint URL-path-encodes each segment of an endpoint string to
// prevent path injection when the value is interpolated into an API URL.
func escapeEndpoint(endpoint string) string {
parts := strings.Split(endpoint, "/")
for i, p := range parts {
parts[i] = url.PathEscape(p)
}
return strings.Join(parts, "/")
Comment on lines +254 to +258
Comment on lines +253 to +258
}

// ghAPIGet calls the GitHub REST API via gh cli and returns the parsed JSON.
func ghAPIGet(ctx context.Context, endpoint string, repo string) (map[string]any, error) {
if err := validateAPIEndpoint(endpoint); err != nil {
return nil, fmt.Errorf("invalid endpoint %q: %w", endpoint, err)
}
ownerRepo, host := repoutil.NormalizeRepoForAPI(repo)
outcomeEvalLog.Printf("gh api GET: repo=%s, endpoint=%s, host=%q", ownerRepo, endpoint, host)
args := []string{"api", fmt.Sprintf("repos/%s/%s", escapeOwnerRepo(ownerRepo), endpoint)}
args := []string{"api", fmt.Sprintf("repos/%s/%s", escapeOwnerRepo(ownerRepo), escapeEndpoint(endpoint))}
var output []byte
var err error
if host != "" {
Expand All @@ -280,7 +290,7 @@ func ghAPIGetArray(ctx context.Context, endpoint string, repo string) ([]map[str
return nil, fmt.Errorf("invalid endpoint %q: %w", endpoint, err)
}
ownerRepo, host := repoutil.NormalizeRepoForAPI(repo)
args := []string{"api", fmt.Sprintf("repos/%s/%s", escapeOwnerRepo(ownerRepo), endpoint)}
args := []string{"api", fmt.Sprintf("repos/%s/%s", escapeOwnerRepo(ownerRepo), escapeEndpoint(endpoint))}
var output []byte
var err error
if host != "" {
Expand Down