Skip to content

fix: secure repo url#989

Open
dennisvankekem wants to merge 2 commits into
mainfrom
APL-1775
Open

fix: secure repo url#989
dennisvankekem wants to merge 2 commits into
mainfrom
APL-1775

Conversation

@dennisvankekem
Copy link
Copy Markdown
Contributor

@dennisvankekem dennisvankekem commented May 11, 2026

Comment thread src/utils/codeRepoUtils.ts Outdated
Comment thread src/openapi/definitions.yaml Outdated
Copy link
Copy Markdown
Contributor

@j-zimnowoda j-zimnowoda left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The URL parsing should ensure that no scrips can be attached but should not enforce any particular domain names. Try to keep it git provider agnostic.

@j-zimnowoda j-zimnowoda self-requested a review May 12, 2026 10:13
repoUrl:
description: Path to a remote git repo without protocol. Will use https to access.
pattern: ^(.+@)*([\w\d\.]+)(:[\d]+){0,1}/*(.*)$
pattern: '^(?:(?:https://)?[A-Za-z0-9.-]+\.[A-Za-z]{2,}|git@[A-Za-z0-9.-]+\.[A-Za-z]{2,}:)/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+(?:\.git)?$'
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This pattern does not work correctly for git@ SSH urls. The non-capturing group incorrectly ends at git@[...]:, causing the pattern to require a slash / that breaks standard SSH URLs like git@host:owner/repo.

repoUrl:
description: Path to a remote git repo without protocol. Will use https to access.
pattern: ^(.+@)*([\w\d\.]+)(:[\d]+){0,1}/*(.*)$
pattern: '^(?:(?:https://)?[A-Za-z0-9.-]+\.[A-Za-z]{2,}|git@[A-Za-z0-9.-]+\.[A-Za-z]{2,}:)/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+(?:\.git)?$'
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This pattern only supports two path segments, while normalizeRepoUrl (and the tests) handles three or more, which may cause issues with GitLab subgroups. (e.g., https://gitlab.example.com/platform/backend/my-repo)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants