Potential fix for code scanning alert no. 198: Server-side request forgery

[breadddevv]

Potential fix for https://github.com/PlanetaryOrbit/orbit/security/code-scanning/198

General fix: ensure any user-influenced values used in outbound request URLs are strictly validated and canonicalized before interpolation; reject invalid values early. Keep hostname fixed and only allow safe numeric identifiers in path/filter components.

Best fix here (without changing functionality): in utils/roblox.ts inside getUsersWithinAGroupRoleset, normalize and validate groupid and roleid to safe positive integers, then use the normalized values for rolePath and URL construction. This preserves current behavior for valid IDs while blocking malformed/unsafe values and satisfying CodeQL by adding sink-side sanitization.

Changes needed:

• Edit utils/roblox.ts in getUsersWithinAGroupRoleset:
  • Add local validated constants (e.g., safeGroupId, safeRoleId).
  • Return failure if either is not a safe positive integer.
  • Replace URL/path interpolation to use the safe constants.
• No import changes required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Summary by CodeRabbit

• Bug Fixes
  • Strengthened validation of group and role identifiers to ensure only properly formatted, safe numeric values are processed.
  • Invalid or malformed identifiers now return clear, descriptive error messages with appropriate feedback.
  • Enhanced input validation helps prevent silent failures and improves application stability when invalid identifiers are encountered.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e9394148-de13-45eb-a621-b9d97c0fb3b0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• ✅ Review completed - (🔄 Check again to review again)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch alert-autofix-198

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}