This is an automated email from the ASF dual-hosted git repository.
Startrekzky pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/devlake.git
The following commit(s) were added to refs/heads/main by this push:
new 82cab8b0b refactor(api): rename GetURIStringPointer to
ResolveRequestURI and reject absolute relativePath (#9043)
82cab8b0b is described below
commit 82cab8b0bc911ed4f0a68dd9b652bf3dacde7334
Author: Klesh Wong <[email protected]>
AuthorDate: Tue Aug 11 21:53:12 2026 +0800
refactor(api): rename GetURIStringPointer to ResolveRequestURI and reject
absolute relativePath (#9043)
url.URL.ResolveReference silently discards the base URL when the reference
is absolute or protocol-relative, which would make the request target the
wrong host without any error. Validate relativePath up front and document
the resolution semantics on the renamed function.
Co-authored-by: Louis.z <[email protected]>
---
backend/helpers/pluginhelper/api/api_client.go | 13 ++++++++++---
backend/plugins/github/token/refresh_api_client.go | 2 +-
2 files changed, 11 insertions(+), 4 deletions(-)
diff --git a/backend/helpers/pluginhelper/api/api_client.go
b/backend/helpers/pluginhelper/api/api_client.go
index 7354a29db..9e731f3fe 100644
--- a/backend/helpers/pluginhelper/api/api_client.go
+++ b/backend/helpers/pluginhelper/api/api_client.go
@@ -324,7 +324,7 @@ func (apiClient *ApiClient) Do(
body interface{},
headers http.Header,
) (*http.Response, errors.Error) {
- uri, err := GetURIStringPointer(apiClient.endpoint, path, query)
+ uri, err := ResolveRequestURI(apiClient.endpoint, path, query)
if err != nil {
return nil, errors.Default.Wrap(err, fmt.Sprintf("Unable to
construct URI from %s, %s, %s", apiClient.endpoint, path, query))
}
@@ -453,8 +453,12 @@ func UnmarshalResponseXML(res *http.Response, v
interface{}) errors.Error {
return nil
}
-// GetURIStringPointer FIXME ...
-func GetURIStringPointer(baseUrl string, relativePath string, query
url.Values) (*string, errors.Error) {
+// ResolveRequestURI combines baseUrl, relativePath and query into the
absolute URI used
+// for an API request. relativePath must be a relative reference (no scheme or
host of its
+// own): url.URL.ResolveReference resolves an absolute reference by discarding
the base
+// entirely (RFC 3986 ยง5.3), so an absolute or protocol-relative relativePath
would silently
+// ignore baseUrl and target whatever host it carries instead.
+func ResolveRequestURI(baseUrl string, relativePath string, query url.Values)
(*string, errors.Error) {
// If the base URL doesn't end with a slash, and has a relative path
attached
// the values will be removed by the Go package, therefore we need to
add a missing slash.
AddMissingSlashToURL(&baseUrl)
@@ -468,6 +472,9 @@ func GetURIStringPointer(baseUrl string, relativePath
string, query url.Values)
if err != nil {
return nil, errors.Convert(err)
}
+ if u.IsAbs() || u.Host != "" {
+ return nil, errors.BadInput.New(fmt.Sprintf("relativePath must
be a relative path, not an absolute URL: %s", relativePath))
+ }
if query != nil {
queryString := u.Query()
for key, values := range query {
diff --git a/backend/plugins/github/token/refresh_api_client.go
b/backend/plugins/github/token/refresh_api_client.go
index 1db6f6917..134ab2f7d 100644
--- a/backend/plugins/github/token/refresh_api_client.go
+++ b/backend/plugins/github/token/refresh_api_client.go
@@ -74,7 +74,7 @@ func (c *refreshApiClient) Post(path string, query
url.Values, body interface{},
}
func (c *refreshApiClient) do(method, path string, query url.Values, body
interface{}, headers http.Header) (*http.Response, errors.Error) {
- uri, err := api.GetURIStringPointer(c.endpoint, path, query)
+ uri, err := api.ResolveRequestURI(c.endpoint, path, query)
if err != nil {
return nil, err
}
