@molecule/api-git-provider-smolforge 1.0.2 → 1.0.4

package/dist/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAEV,WAAW,EAGZ,MAAM,4BAA4B,CAAA;AAqDnC;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,EAAE,WA8DtB,CAAA"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAEV,WAAW,EAGZ,MAAM,4BAA4B,CAAA;AA4EnC;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,EAAE,WAkEtB,CAAA"}

package/dist/provider.js

@@ -37,6 +37,27 @@ const normalize = (repo, host) => {
         description: repo.description ?? null,
     };
 };
+/**
+ * Validates a (possibly user-supplied) host before it is interpolated into
+ * an API base URL. Fails closed: anything carrying URL structure — path
+ * separators, query strings, fragments, userinfo (`token@host`), scheme
+ * separators — is rejected, so the bearer-token-bearing request can never
+ * be reshaped to an attacker-chosen path or credential-prefixed URL.
+ * Allowed: hostname letters/digits/dots/hyphens plus an optional port.
+ */
+const assertValidHost = (host) => {
+    if (!/^[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?(?::\d{1,5})?$/.test(host)) {
+        throw new Error(`Invalid git provider host: ${JSON.stringify(host)}`);
+    }
+    return host;
+};
+/**
+ * URL-encodes each `/`-separated segment of an `owner/name`-style repo
+ * path, preserving the separators: a path containing spaces, `?`, `#`, or
+ * other URL-meaningful bytes must not be able to alter the request target
+ * the token is sent to.
+ */
+const encodeRepoPath = (path) => path.split('/').map(encodeURIComponent).join('/');
 /**
  * The SmolForge provider.
  *
@@ -58,6 +79,7 @@ export const provider = {
     // substitute the connected account's username here.
     basicAuthUsername: null,
     apiBaseForHost(host) {
+        assertValidHost(host);
         return `https://${host}/api`;
     },
     apiHeaders(token) {
@@ -85,7 +107,10 @@ export const provider = {
         const { get } = await import('@molecule/api-http');
         const base = this.apiBaseForHost(input.host);
         try {
-            const response = await get(`${base}/repos/${input.path}`, { headers: this.apiHeaders(input.token), timeout: 15_000 });
+            const response = await get(`${base}/repos/${encodeRepoPath(input.path)}`, {
+                headers: this.apiHeaders(input.token),
+                timeout: 15_000,
+            });
             // Single lookups are wrapped too; fall back to the bare object so a shape
             // change in either direction still resolves rather than returning null.
             const repo = response.data?.repository ?? response.data;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/api-git-provider-smolforge",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Git hosting provider for SmolForge (forge.smol.ai) — OAuth endpoints, token auth shape, repository listing and lookup.",
   "type": "module",
   "main": "dist/index.js",
@@ -33,11 +33,11 @@
     "directory": "packages/api/bonds/git-provider/smolforge"
   },
   "devDependencies": {
-    "@molecule/api-git-provider": "1.0.2",
+    "@molecule/api-git-provider": "1.0.4",
     "@molecule/api-http": "1.0.1",
     "@types/node": "26.1.2",
     "typescript": "6.0.3",
-    "vitest": "4.1.10"
+    "vitest": "4.1.11"
   },
   "peerDependencies": {
     "@molecule/api-git-provider": "^1.0.2",