Abhishek-Mallick / Abhishek-Mallick/universal-box

Security: Sanitize User-Supplied GitHub URL in `get` Command

Abierto
#234 3 comentarios 0 reacciones 1 asignado Reclamado por @Mahita07 Ver en GitHub
enhancement good first issue hacktoberfest
Lenguaje dominante
JavaScript
Estrellas
47
Forks
41
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

## Feature Request

**Is your feature request related to a problem you're trying to solve with Universal-Box? Please describe.**
Currently, the `get` command accepts a GitHub repository URL directly from the user. Without validation, it could allow malformed or malicious URLs (e.g., command injections, non-GitHub domains, or scripts), potentially causing security issues or unexpected behavior.

**Describe the solution you'd like**
Implement strict input sanitization and validation for user-supplied URLs in the get command:
- Allow only valid GitHub repository URLs (https://github.com/{user}/{repo} or https://www.github.com/{user}/{repo}).
- Reject URLs with query parameters, special characters, or other schemes (file://, ftp://, etc.).
- Use a regex-based or URL-parsing validation approach to ensure the URL structure and domain integrity.

**Describe alternatives you've considered**
- Whitelisting specific domains (only `github.com` and `www.github.com`).
- Escaping user input before shell execution.
- Requiring a token-authenticated fetch instead of direct URL usage.

**How would this feature improve Universal-Box?**
Enhances security and reliability of the `get` command by preventing misuse, accidental errors, and potential injection vectors.
This ensures Universal-Box safely handles user input without compromising on developer convenience.

**Additional context**
This validation step can be placed before cloning logic in the get command workflow.
Optionally, a `--force` flag could bypass validation (for internal or advanced usage).

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Find the `get` command implementation, likely in a CLI handler file. Examine how the GitHub URL is currently received and used. Research URL validation libraries or regex patterns for GitHub repository URLs. The validation should be added before the cloning logic. Check for existing tests for the `get` command to understand the testing pattern and add tests for valid and invalid URLs.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
javascript, node.js
Área
cli, security
Tipo de issue
Nueva funcionalidad
Dificultad
3/5
Tiempo estimado
1-2 días
Estado de actividad
Estancado
Claridad
Bien especificado
Aptitud para principiantes
45/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.