fix(search): strip GitHub qualifier injection from search filter input#691
fix(search): strip GitHub qualifier injection from search filter input#691anshul23102 wants to merge 1 commit into
Conversation
The search filter value was appended to the GitHub query string verbatim. A caller who types a GitHub qualifier such as 'repo:other/repo' into the search field could override the repository scope and retrieve issues from unintended repositories, bypassing the username-scoped query the hook builds. Strip key:value qualifier patterns from filters.search before appending it to the query. This allows plain keyword searches to work as intended while preventing operator injection. Closes GitMetricsLab#690
✅ Deploy Preview for github-spy ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
github-actions
Bot
added
gssoc:approved
level:intermediate
quality:clean
type:accessibility
labels
📝 WalkthroughWalkthroughThe PR sanitizes GitHub API search queries by filtering qualifier tokens from user input before constructing the search string. The change removes ChangesSearch Input Sanitization
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/hooks/useGitHubData.ts (1)
49-59: 💤 Low valueSanitization logic is sound for the intended threat model.
The regex effectively strips common GitHub qualifiers (
repo:,author:,is:,label:, etc.) and prevents query scope bypass. The implementation correctly handles negative qualifiers like-label:bugsince the hyphen is included in the character class.One edge case to consider: quoted qualifier values with embedded spaces (e.g.,
label:"bug fix") will be partially stripped, leaving orphaned tokens likefix". This isn't a security bypass but could cause unexpected search behavior.Optional: Handle quoted values more completely
const sanitizedSearch = filters.search - .replace(/[a-zA-Z_-]+:[^\s]*/g, '') + .replace(/[a-zA-Z_-]+:(?:"[^"]*"|[^\s]*)/g, '') .trim();🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/hooks/useGitHubData.ts` around lines 49 - 59, The current sanitization leaves orphaned tokens when qualifiers use quoted values (e.g., label:"bug fix"); update the logic that computes sanitizedSearch in useGitHubData (where filters.search is processed) to first remove quoted qualifiers and then remove unquoted qualifiers — e.g., perform a replace pass that strips patterns like key:"..."(including the quotes and inner spaces) before the existing regex that removes key:token forms — so sanitizedSearch no longer contains leftover fragments like fix".
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/hooks/useGitHubData.ts`:
- Around line 49-59: The current sanitization leaves orphaned tokens when
qualifiers use quoted values (e.g., label:"bug fix"); update the logic that
computes sanitizedSearch in useGitHubData (where filters.search is processed) to
first remove quoted qualifiers and then remove unquoted qualifiers — e.g.,
perform a replace pass that strips patterns like key:"..."(including the quotes
and inner spaces) before the existing regex that removes key:token forms — so
sanitizedSearch no longer contains leftover fragments like fix".
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b5a1f6cb-17ed-46b1-9e5d-498e4269002c
📒 Files selected for processing (1)
src/hooks/useGitHubData.ts
1 participant
Description
The search filter value in useGitHubData was appended verbatim to the GitHub search query string. A user who typed a GitHub qualifier (e.g. repo:other/repo, author:someone) into the search field could override the query operators the hook already set, retrieving issues outside the intended username scope.
Root Cause
The filter value was concatenated without sanitization:
A search term containing repo:org/repo would inject an extra repository scope, bypassing the author:-based filter.
Related Issue
Closes #690
Type of Change
Changes Made
Testing Done
Checklist
Summary by CodeRabbit