Description

There is a lack of input validation for user-provided values in certain functions.

In the GitForge.get_repo() function for GitHub, the user can provide any string for the owner and repo fields. These inputs are not validated or safely encoded and are sent directly to the server.

Impact

This means a user can add path traversal patterns like ../ in the input to access any other endpoints on api.github.com that were not intended.

Patches

Users should upgrade immediately to v0.4.3. All prior versions are vulnerable.

Workarounds

None

References

Fixed by: #50 (which is available in v0.4.3).

Credits

Thanks to splitline from the DEVCORE Research Team for reporting this issue.