Abhishek-Mallick / Abhishek-Mallick/universal-box
Security: Sanitize User-Supplied GitHub URL in `get` Command
- Lingua principale
- JavaScript
- Stelle
- 47
- Fork
- 41
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
## Feature Request
**Is your feature request related to a problem you're trying to solve with Universal-Box? Please describe.**
Currently, the `get` command accepts a GitHub repository URL directly from the user. Without validation, it could allow malformed or malicious URLs (e.g., command injections, non-GitHub domains, or scripts), potentially causing security issues or unexpected behavior.
**Describe the solution you'd like**
Implement strict input sanitization and validation for user-supplied URLs in the get command:
- Allow only valid GitHub repository URLs (https://github.com/{user}/{repo} or https://www.github.com/{user}/{repo}).
- Reject URLs with query parameters, special characters, or other schemes (file://, ftp://, etc.).
- Use a regex-based or URL-parsing validation approach to ensure the URL structure and domain integrity.
**Describe alternatives you've considered**
- Whitelisting specific domains (only `github.com` and `www.github.com`).
- Escaping user input before shell execution.
- Requiring a token-authenticated fetch instead of direct URL usage.
**How would this feature improve Universal-Box?**
Enhances security and reliability of the `get` command by preventing misuse, accidental errors, and potential injection vectors.
This ensures Universal-Box safely handles user input without compromising on developer convenience.
**Additional context**
This validation step can be placed before cloning logic in the get command workflow.
Optionally, a `--force` flag could bypass validation (for internal or advanced usage).
Guida per i contributori
Apri la guida per i contributori
Direzione di ricerca
Find the `get` command implementation, likely in a CLI handler file. Examine how the GitHub URL is currently received and used. Research URL validation libraries or regex patterns for GitHub repository URLs. The validation should be added before the cloning logic. Check for existing tests for the `get` command to understand the testing pattern and add tests for valid and invalid URLs.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- javascript, node.js
- Ambito
- cli, security
- Tipo di issue
- Funzionalità
- Difficoltà
- 3/5
- Tempo stimato
- 1-2 giorni
- Stato di attività
- Ferma
- Chiarezza
- Specificata chiaramente
- Idoneità per principianti
- 45/100