Abhishek-Mallick / Abhishek-Mallick/universal-box

Security: Sanitize User-Supplied GitHub URL in `get` Command

Open
#234 3 comments 0 reactions 1 assignee Claimed by @Mahita07 View on GitHub
enhancement good first issue hacktoberfest
Dominant language
JavaScript
Stars
47
Forks
41
PR merge metrics
No merged PRs in 30d

Description

## Feature Request

**Is your feature request related to a problem you're trying to solve with Universal-Box? Please describe.**
Currently, the `get` command accepts a GitHub repository URL directly from the user. Without validation, it could allow malformed or malicious URLs (e.g., command injections, non-GitHub domains, or scripts), potentially causing security issues or unexpected behavior.

**Describe the solution you'd like**
Implement strict input sanitization and validation for user-supplied URLs in the get command:
- Allow only valid GitHub repository URLs (https://github.com/{user}/{repo} or https://www.github.com/{user}/{repo}).
- Reject URLs with query parameters, special characters, or other schemes (file://, ftp://, etc.).
- Use a regex-based or URL-parsing validation approach to ensure the URL structure and domain integrity.

**Describe alternatives you've considered**
- Whitelisting specific domains (only `github.com` and `www.github.com`).
- Escaping user input before shell execution.
- Requiring a token-authenticated fetch instead of direct URL usage.

**How would this feature improve Universal-Box?**
Enhances security and reliability of the `get` command by preventing misuse, accidental errors, and potential injection vectors.
This ensures Universal-Box safely handles user input without compromising on developer convenience.

**Additional context**
This validation step can be placed before cloning logic in the get command workflow.
Optionally, a `--force` flag could bypass validation (for internal or advanced usage).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.