Abhishek-Mallick / Abhishek-Mallick/universal-box

Security: Sanitize User-Supplied GitHub URL in `get` Command

Aperta
#234 3 commenti 0 reazioni 1 assegnatario Rivendicata da @Mahita07 Vedi su GitHub
enhancement good first issue hacktoberfest
Lingua principale
JavaScript
Stelle
47
Fork
41
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

## Feature Request

**Is your feature request related to a problem you're trying to solve with Universal-Box? Please describe.**
Currently, the `get` command accepts a GitHub repository URL directly from the user. Without validation, it could allow malformed or malicious URLs (e.g., command injections, non-GitHub domains, or scripts), potentially causing security issues or unexpected behavior.

**Describe the solution you'd like**
Implement strict input sanitization and validation for user-supplied URLs in the get command:
- Allow only valid GitHub repository URLs (https://github.com/{user}/{repo} or https://www.github.com/{user}/{repo}).
- Reject URLs with query parameters, special characters, or other schemes (file://, ftp://, etc.).
- Use a regex-based or URL-parsing validation approach to ensure the URL structure and domain integrity.

**Describe alternatives you've considered**
- Whitelisting specific domains (only `github.com` and `www.github.com`).
- Escaping user input before shell execution.
- Requiring a token-authenticated fetch instead of direct URL usage.

**How would this feature improve Universal-Box?**
Enhances security and reliability of the `get` command by preventing misuse, accidental errors, and potential injection vectors.
This ensures Universal-Box safely handles user input without compromising on developer convenience.

**Additional context**
This validation step can be placed before cloning logic in the get command workflow.
Optionally, a `--force` flag could bypass validation (for internal or advanced usage).

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Find the `get` command implementation, likely in a CLI handler file. Examine how the GitHub URL is currently received and used. Research URL validation libraries or regex patterns for GitHub repository URLs. The validation should be added before the cloning logic. Check for existing tests for the `get` command to understand the testing pattern and add tests for valid and invalid URLs.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
javascript, node.js
Ambito
cli, security
Tipo di issue
Funzionalità
Difficoltà
3/5
Tempo stimato
1-2 giorni
Stato di attività
Ferma
Chiarezza
Specificata chiaramente
Idoneità per principianti
45/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.