fix: security vulnerability in attachment downloads

src/commands/auth/auth-status.ts

@@ -2,6 +2,7 @@ import { Command } from "@cliffy/command"
 import { gql } from "../../__codegen__/gql.ts"
 import { handleError } from "../../utils/errors.ts"
 import { getGraphQLClient } from "../../utils/graphql.ts"
+import { LINEAR_WEB_BASE_URL } from "../../const.ts"
 
 const viewerQuery = gql(`
   query AuthStatus {
@@ -33,7 +34,7 @@ export const statusCommand = new Command()
 
       console.log(`Workspace: ${org.name}`)
       console.log(`  Slug: ${org.urlKey}`)
-      console.log(`  URL: https://linear.app/${org.urlKey}`)
+      console.log(`  URL: ${LINEAR_WEB_BASE_URL}/${org.urlKey}`)
 
       console.log(`User: ${viewer.name}`)
       if (viewer.displayName !== viewer.name) {

src/commands/auth/auth-whoami.ts

@@ -2,6 +2,7 @@ import { Command } from "@cliffy/command"
 import { gql } from "../../__codegen__/gql.ts"
 import { handleError } from "../../utils/errors.ts"
 import { getGraphQLClient } from "../../utils/graphql.ts"
+import { LINEAR_WEB_BASE_URL } from "../../const.ts"
 
 const viewerQuery = gql(`
   query AuthStatus {
@@ -33,7 +34,7 @@ export const whoamiCommand = new Command()
 
       console.log(`Workspace: ${org.name}`)
       console.log(`  Slug: ${org.urlKey}`)
-      console.log(`  URL: https://linear.app/${org.urlKey}`)
+      console.log(`  URL: ${LINEAR_WEB_BASE_URL}/${org.urlKey}`)
 
       console.log(`User: ${viewer.name}`)
       if (viewer.displayName !== viewer.name) {

src/commands/initiative/initiative-list.ts

@@ -6,6 +6,7 @@ import { getGraphQLClient } from "../../utils/graphql.ts"
 import { padDisplay, truncateText } from "../../utils/display.ts"
 import { getOption } from "../../config.ts"
 import { shouldShowSpinner } from "../../utils/hyperlink.ts"
+import { LINEAR_WEB_BASE_URL } from "../../const.ts"
 import {
   handleError,
   NotFoundError,
@@ -100,7 +101,7 @@ export const listCommand = new Command()
         workspace = result.viewer.organization.urlKey
       }
 
-      const url = `https://linear.app/${workspace}/initiatives`
+      const url = `${LINEAR_WEB_BASE_URL}/${workspace}/initiatives`
       const destination = app ? "Linear.app" : "web browser"
       console.log(`Opening ${url} in ${destination}`)
       await open(url, app ? { app: { name: "Linear" } } : undefined)

src/commands/issue/issue-view.ts

@@ -23,6 +23,10 @@ import {
 } from "../../utils/hyperlink.ts"
 import { createHyperlinkExtension } from "../../utils/charmd-hyperlink-extension.ts"
 import { handleError, ValidationError } from "../../utils/errors.ts"
+import {
+  LINEAR_PRIVATE_UPLOAD_HOST,
+  LINEAR_UPLOAD_HOSTNAMES,
+} from "../../const.ts"
 
 export const viewCommand = new Command()
   .name("view")
@@ -476,11 +480,7 @@ export function extractLinearLinkInfo(
 
   visit(tree, "link", (node: Link) => {
     // Only extract links to Linear uploads
-    if (
-      node.url &&
-      (node.url.includes("uploads.linear.app") ||
-        node.url.includes("public.linear.app"))
-    ) {
+    if (node.url && getLinearUploadHost(node.url)) {
       // Get link text from first child if it's a text node
       const textNode = node.children[0]
       const text = textNode && textNode.type === "text" ? textNode.value : null
@@ -533,6 +533,15 @@ export async function getUrlHash(url: string): Promise<string> {
   return encodeHex(hashArray).substring(0, 16)
 }
 
+export function getLinearUploadHost(url: string): string | null {
+  try {
+    const { hostname } = new URL(url)
+    return LINEAR_UPLOAD_HOSTNAMES.includes(hostname) ? hostname : null
+  } catch {
+    return null
+  }
+}
+
 /**
  * download an image to the cache directory if not already cached
  * returns the local file path
@@ -556,7 +565,7 @@ async function downloadImage(
   }
 
   const headers: Record<string, string> = {}
-  if (url.includes("uploads.linear.app")) {
+  if (getLinearUploadHost(url) === LINEAR_PRIVATE_UPLOAD_HOST) {
     const apiKey = getResolvedApiKey()
     if (apiKey) {
       headers["Authorization"] = apiKey
@@ -674,10 +683,8 @@ async function downloadAttachments(
   for (const attachment of attachments) {
     try {
       // Skip non-file URLs (e.g., external links)
-      // Linear uses uploads.linear.app for private and public.linear.app for public images
-      const isLinearUpload = attachment.url.includes("uploads.linear.app") ||
-        attachment.url.includes("public.linear.app")
-      if (!isLinearUpload) {
+      const uploadHost = getLinearUploadHost(attachment.url)
+      if (!uploadHost) {
         continue
       }
 
@@ -694,8 +701,7 @@ async function downloadAttachments(
       }
 
       const headers: Record<string, string> = {}
-      // Only add auth header for private uploads, not public URLs
-      if (attachment.url.includes("uploads.linear.app")) {
+      if (uploadHost === LINEAR_PRIVATE_UPLOAD_HOST) {
         const apiKey = getResolvedApiKey()
         if (apiKey) {
           headers["Authorization"] = apiKey

src/commands/project/project-list.ts

@@ -8,6 +8,7 @@ import type {
 } from "../../__codegen__/graphql.ts"
 import { getGraphQLClient } from "../../utils/graphql.ts"
 import { getTimeAgo, padDisplay } from "../../utils/display.ts"
+import { LINEAR_WEB_BASE_URL } from "../../const.ts"
 import { getTeamKey } from "../../utils/linear.ts"
 import { getOption } from "../../config.ts"
 import { shouldShowSpinner } from "../../utils/hyperlink.ts"
@@ -88,8 +89,8 @@ export const listCommand = new Command()
       // Determine team to filter by for URL construction
       const teamKey = allTeams ? null : (team?.toUpperCase() || getTeamKey())
       const url = teamKey
-        ? `https://linear.app/${workspace}/team/${teamKey}/projects/all`
-        : `https://linear.app/${workspace}/projects/all`
+        ? `${LINEAR_WEB_BASE_URL}/${workspace}/team/${teamKey}/projects/all`
+        : `${LINEAR_WEB_BASE_URL}/${workspace}/projects/all`
       const destination = app ? "Linear.app" : "web browser"
       console.log(`Opening ${url} in ${destination}`)
       await open(url, app ? { app: { name: "Linear" } } : undefined)

src/commands/team/team-autolinks.ts

@@ -2,6 +2,7 @@ import { Command } from "@cliffy/command"
 import { getTeamKey } from "../../utils/linear.ts"
 import { getOption } from "../../config.ts"
 import { CliError, handleError, ValidationError } from "../../utils/errors.ts"
+import { LINEAR_WEB_BASE_URL } from "../../const.ts"
 
 export const autolinksCommand = new Command()
   .name("autolinks")
@@ -32,7 +33,7 @@ export const autolinksCommand = new Command()
           "-f",
           `key_prefix=${teamId}-`,
           "-f",
-          `url_template=https://linear.app/${workspace}/issue/${teamId}-<num>`,
+          `url_template=${LINEAR_WEB_BASE_URL}/${workspace}/issue/${teamId}-<num>`,
         ],
         stdin: "inherit",
         stdout: "inherit",

src/commands/team/team-list.ts

@@ -8,6 +8,7 @@ import { getTimeAgo, padDisplay } from "../../utils/display.ts"
 import { getOption } from "../../config.ts"
 import { shouldShowSpinner } from "../../utils/hyperlink.ts"
 import { handleError, ValidationError } from "../../utils/errors.ts"
+import { LINEAR_WEB_BASE_URL } from "../../const.ts"
 
 const GetTeams = gql(`
   query GetTeams($filter: TeamFilter, $first: Int, $after: String) {
@@ -55,7 +56,7 @@ export const listCommand = new Command()
           )
         }
 
-        const url = `https://linear.app/${workspace}/settings/teams`
+        const url = `${LINEAR_WEB_BASE_URL}/${workspace}/settings/teams`
         const destination = app ? "Linear.app" : "web browser"
         console.log(`Opening ${url} in ${destination}`)
         await open(url, app ? { app: { name: "Linear" } } : undefined)

src/const.ts

@@ -0,0 +1,11 @@
+export const LINEAR_WEB_BASE_URL = "https://linear.app"
+export const LINEAR_API_ENDPOINT = "https://api.linear.app/graphql"
+
+/** Requires auth to access. */
+export const LINEAR_PRIVATE_UPLOAD_HOST = "uploads.linear.app"
+export const LINEAR_PUBLIC_UPLOAD_HOST = "public.linear.app"
+
+export const LINEAR_UPLOAD_HOSTNAMES: readonly string[] = [
+  LINEAR_PRIVATE_UPLOAD_HOST,
+  LINEAR_PUBLIC_UPLOAD_HOST,
+]

src/utils/actions.ts

@@ -9,6 +9,7 @@ import {
 import { getOption } from "../config.ts"
 import { encodeBase64 } from "@std/encoding/base64"
 import { getNoIssueFoundMessage, startVcsWork } from "./vcs.ts"
+import { LINEAR_WEB_BASE_URL } from "../const.ts"
 
 export async function openIssuePage(
   providedId?: string,
@@ -28,7 +29,7 @@ export async function openIssuePage(
     Deno.exit(1)
   }
 
-  const url = `https://linear.app/${workspace}/issue/${issueId}`
+  const url = `${LINEAR_WEB_BASE_URL}/${workspace}/issue/${issueId}`
   const destination = options.app ? "Linear.app" : "web browser"
   console.log(`Opening ${url} in ${destination}`)
   await open(url, options.app ? { app: { name: "Linear" } } : undefined)
@@ -46,7 +47,7 @@ export async function openProjectPage(
     Deno.exit(1)
   }
 
-  const url = `https://linear.app/${workspace}/project/${projectId}`
+  const url = `${LINEAR_WEB_BASE_URL}/${workspace}/project/${projectId}`
   const destination = options.app ? "Linear.app" : "web browser"
   console.log(`Opening ${url} in ${destination}`)
   await open(url, options.app ? { app: { name: "Linear" } } : undefined)
@@ -74,7 +75,7 @@ export async function openTeamAssigneeView(options: { app?: boolean } = {}) {
   }
   const filter = encodeBase64(JSON.stringify(filterObj)).replace(/=/g, "")
   const url =
-    `https://linear.app/${workspace}/team/${teamId}/active?filter=${filter}`
+    `${LINEAR_WEB_BASE_URL}/${workspace}/team/${teamId}/active?filter=${filter}`
   await open(url, options.app ? { app: { name: "Linear" } } : undefined)
 }
 

src/utils/graphql.ts

@@ -4,6 +4,7 @@ import { getCliWorkspace, getOption } from "../config.ts"
 import { getCredentialApiKey } from "../credentials.ts"
 import denoConfig from "../../deno.json" with { type: "json" }
 import { extractGraphQLMessage, isDebugMode } from "./errors.ts"
+import { LINEAR_API_ENDPOINT } from "../const.ts"
 
 export { ClientError }
 
@@ -89,8 +90,7 @@ export function getResolvedApiKey(): string | undefined {
  * Get the GraphQL endpoint URL.
  */
 export function getGraphQLEndpoint(): string {
-  return Deno.env.get("LINEAR_GRAPHQL_ENDPOINT") ||
-    "https://api.linear.app/graphql"
+  return Deno.env.get("LINEAR_GRAPHQL_ENDPOINT") || LINEAR_API_ENDPOINT
 }
 
 /**

test/commands/issue/image-download.test.ts

@@ -1,6 +1,7 @@
 import { assertEquals } from "@std/assert"
 import {
   extractImageInfo,
+  extractLinearLinkInfo,
   getUrlHash,
   replaceImageUrls,
 } from "../../../src/commands/issue/issue-view.ts"
@@ -109,6 +110,25 @@ Deno.test("replaceImageUrls - handles empty map", async () => {
   assertEquals(result.includes("https://example.com/img.png"), true)
 })
 
+Deno.test("extractLinearLinkInfo - extracts Linear upload links", () => {
+  const md = "See [file](https://uploads.linear.app/abc/doc.pdf)"
+  const links = extractLinearLinkInfo(md)
+  assertEquals(links.length, 1)
+  assertEquals(links[0].url, "https://uploads.linear.app/abc/doc.pdf")
+})
+
+Deno.test("extractLinearLinkInfo - ignores spoofed domain in path", () => {
+  const md = "See [file](https://example.com/uploads.linear.app/doc.pdf)"
+  const links = extractLinearLinkInfo(md)
+  assertEquals(links.length, 0)
+})
+
+Deno.test("extractLinearLinkInfo - ignores spoofed subdomain", () => {
+  const md = "See [file](https://uploads.linear.app.example.com/doc.pdf)"
+  const links = extractLinearLinkInfo(md)
+  assertEquals(links.length, 0)
+})
+
 // Hyperlink utility tests
 
 Deno.test("hyperlink - creates OSC-8 escape sequence", () => {