security: repo-flags endpoints build API paths with raw, unescaped segments #711

New issue

Closed

opened 2026-10-04 18:21:36 +00:00 by hexajon · 0 comments

hexajon commented

2026-10-04 18:21:36 +00:00

Owner

What happens

The repo-flags client builds its API paths with raw fmt.Sprintf, not the segment-wise escaping the other builders use. In internal/gitea/client_repo_flags.go, ListRepoFlags (:18), GetRepoFlag (:24), AddRepoFlag (:30), and RemoveRepoFlag (:36) each interpolate owner, repo, and flag directly, e.g. fmt.Sprintf("/repos/%s/%s/flags/%s", owner, repo, flag). Every other request-path builder routes its segments through the package's escapePath (segment-wise url.PathEscape); this family was missed.

Scope

Same-origin path reshaping only; the repo-scope boundary is unaffected. Hygiene. Per the #708 sweep this is the one raw request-path builder left after the rest were migrated. The fix is non-breaking: escaping a slug with no special characters is a no-op.

Fix (direction)

Route owner, repo, and flag through escapePath, as the sibling builders do.

Acceptance criteria

The four repo-flags endpoints escape each path segment.

## What happens The repo-flags client builds its API paths with raw `fmt.Sprintf`, not the segment-wise escaping the other builders use. In `internal/gitea/client_repo_flags.go`, `ListRepoFlags` (`:18`), `GetRepoFlag` (`:24`), `AddRepoFlag` (`:30`), and `RemoveRepoFlag` (`:36`) each interpolate `owner`, `repo`, and `flag` directly, e.g. `fmt.Sprintf("/repos/%s/%s/flags/%s", owner, repo, flag)`. Every other request-path builder routes its segments through the package's `escapePath` (segment-wise `url.PathEscape`); this family was missed. ## Scope Same-origin path reshaping only; the repo-scope boundary is unaffected. Hygiene. Per the #708 sweep this is the one raw request-path builder left after the rest were migrated. The fix is non-breaking: escaping a slug with no special characters is a no-op. ## Fix (direction) Route `owner`, `repo`, and `flag` through `escapePath`, as the sibling builders do. ## Acceptance criteria - [ ] The four repo-flags endpoints escape each path segment.

hexajon added the

security

severity/low

labels

2026-10-04 18:21:36 +00:00

hexajon added a new dependency

2026-10-05 12:34:15 +00:00

#675 epic: v0.20.0 - breaking: clearer ADR tooling and the write guard on every surface

~~hexajon referenced this issue 2026-10-05 12:34:16 +00:00~~

epic: v0.20.0 - breaking: clearer ADR tooling and the write guard on every surface #675

hexajon referenced this issue from a commit

2026-10-06 18:05:53 +00:00