@molecule/api-git-provider-gitea 1.0.3 → 1.0.4

package/dist/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAEV,WAAW,EAGZ,MAAM,4BAA4B,CAAA;AAmCnC;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,EAAE,WA2DtB,CAAA"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAEV,WAAW,EAGZ,MAAM,4BAA4B,CAAA;AA0DnC;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,EAAE,WA4DtB,CAAA"}

package/dist/provider.js

@@ -23,6 +23,27 @@ const normalize = (repo) => repo.full_name && repo.clone_url
         description: repo.description ?? null,
     }
     : null;
+/**
+ * Validates a (possibly user-supplied) host before it is interpolated into
+ * an API base URL. Fails closed: anything carrying URL structure — path
+ * separators, query strings, fragments, userinfo (`token@host`), scheme
+ * separators — is rejected, so the bearer-token-bearing request can never
+ * be reshaped to an attacker-chosen path or credential-prefixed URL.
+ * Allowed: hostname letters/digits/dots/hyphens plus an optional port.
+ */
+const assertValidHost = (host) => {
+    if (!/^[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?(?::\d{1,5})?$/.test(host)) {
+        throw new Error(`Invalid git provider host: ${JSON.stringify(host)}`);
+    }
+    return host;
+};
+/**
+ * URL-encodes each `/`-separated segment of an `owner/name`-style repo
+ * path, preserving the separators: a path containing spaces, `?`, `#`, or
+ * other URL-meaningful bytes must not be able to alter the request target
+ * the token is sent to.
+ */
+const encodeRepoPath = (path) => path.split('/').map(encodeURIComponent).join('/');
 /**
  * The Gitea provider.
  *
@@ -47,6 +68,7 @@ export const provider = {
     },
     basicAuthUsername: 'x-access-token',
     apiBaseForHost(host) {
+        assertValidHost(host);
         return `https://${host}/api/v1`;
     },
     apiHeaders(token) {
@@ -71,7 +93,7 @@ export const provider = {
         const { get } = await import('@molecule/api-http');
         const base = this.apiBaseForHost(input.host);
         try {
-            const response = await get(`${base}/repos/${input.path}`, {
+            const response = await get(`${base}/repos/${encodeRepoPath(input.path)}`, {
                 headers: this.apiHeaders(input.token),
                 timeout: 15_000,
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/api-git-provider-gitea",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Git hosting provider for Gitea (gitea.com) — OAuth endpoints, token auth shape, repository listing and lookup.",
   "type": "module",
   "main": "dist/index.js",
@@ -33,11 +33,11 @@
     "directory": "packages/api/bonds/git-provider/gitea"
   },
   "devDependencies": {
-    "@molecule/api-git-provider": "1.0.3",
+    "@molecule/api-git-provider": "1.0.4",
     "@molecule/api-http": "1.0.1",
     "@types/node": "26.1.2",
     "typescript": "6.0.3",
-    "vitest": "4.1.10"
+    "vitest": "4.1.11"
   },
   "peerDependencies": {
     "@molecule/api-git-provider": "^1.0.2",