Repository navigation
Conversation
filterOptions passed the owner and name to `gh api graphql` with -F, which reads a value starting with @ from a local file and turns digits into numbers. Use -f, as the pull request lookup does, and validate issues.filter-options' repo as owner/repo with the same pattern. Co-Authored-By: Claude Opus 5.5 <[email protected]>
NoSync
added a commit
to Klartika/paseo-issues-workspaces
that referenced
this pull request
Oct 22, 2026
The same hardening as ajma#12, on this branch's filter options: -f instead of -F for the repository's owner and name, and owner/repo validation. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
filterOptionspassed the repository's owner and name togh api graphqlwith-F, which treats a value starting with@as a file to read (and turns all-digit values into numbers).issues.filter-optionsalso accepted any string asrepo, so a value such as@/some/file/xwas not refused before reachinggh. The callers are this plugin's own screens, so this is hardening rather than an exploitable path, but the pull request lookup already does both things right.-f, aspullRequestsdoes.issues.filter-optionsvalidatesrepowith the sameowner/repopattern asissues.pull-requests(now a sharedrepoSlug), andfilterOptionsparses its input likepullRequests.Tested:
npm run typecheckandnpm test, with tests that the GraphQL call uses-fand that malformed repositories are refused before anyghcall.This touches
shared/issues.tsnear #11; whichever merges second needs a small rebase, which I will do.🤖 Generated with Claude Code