Abhishek-Mallick / Abhishek-Mallick/universal-box
Security: Sanitize User-Supplied GitHub URL in `get` Command
- Dominant language
- JavaScript
- Stars
- 47
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
## Feature Request
**Is your feature request related to a problem you're trying to solve with Universal-Box? Please describe.**
Currently, the `get` command accepts a GitHub repository URL directly from the user. Without validation, it could allow malformed or malicious URLs (e.g., command injections, non-GitHub domains, or scripts), potentially causing security issues or unexpected behavior.
**Describe the solution you'd like**
Implement strict input sanitization and validation for user-supplied URLs in the get command:
- Allow only valid GitHub repository URLs (https://github.com/{user}/{repo} or https://www.github.com/{user}/{repo}).
- Reject URLs with query parameters, special characters, or other schemes (file://, ftp://, etc.).
- Use a regex-based or URL-parsing validation approach to ensure the URL structure and domain integrity.
**Describe alternatives you've considered**
- Whitelisting specific domains (only `github.com` and `www.github.com`).
- Escaping user input before shell execution.
- Requiring a token-authenticated fetch instead of direct URL usage.
**How would this feature improve Universal-Box?**
Enhances security and reliability of the `get` command by preventing misuse, accidental errors, and potential injection vectors.
This ensures Universal-Box safely handles user input without compromising on developer convenience.
**Additional context**
This validation step can be placed before cloning logic in the get command workflow.
Optionally, a `--force` flag could bypass validation (for internal or advanced usage).
Contributor guide
Assessment
This issue has not been assessed yet.