Skip to content

fix(security): validate remote URL and escape commit messages in generate-release.ps1 #673

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
xiaolai wants to merge 2 commits into from
+11 −1
Closed

fix(security): validate remote URL and escape commit messages in generate-release.ps1 #673

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b7bf17b
fix(security): validate remote URL and escape commit messages in gene…
claude[bot] Apr 21, 2026
03cea9a
Merge branch 'main' into fix/nlpm-release-content-injection
IvanMurzak Apr 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion commands/generate-release.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,13 @@ if ($repoUrl -match '^git@github\.com:(.+)') {
$repoUrl = "https://github.com/$($matches[1])"
}

# Validate remote URL is a standard GitHub repo path (guard against tampered remotes)
if ($repoUrl -notmatch '^https://github\.com/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$') {
Write-Error "Unexpected remote URL '$repoUrl' — aborting to prevent unintended GitHub API calls."
Comment on lines +20 to +22
Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The remote URL validation only checks that the URL is on github.com and has an owner/repo shape, but it still allows origin to point to a different GitHub repository. That means a tampered remote can still cause gh api repos/$repoPath/... to fetch and embed data from an attacker-controlled repo. Consider sourcing the repo identity from a trusted channel when available (e.g., $env:GITHUB_REPOSITORY in CI) and/or adding an explicit -RepoPath/-RepoUrl parameter, and then validating that the remote-derived value matches it before continuing.

Copilot uses AI. Check for mistakes.
Pop-Location
exit 1
}
Comment on lines +20 to +25
Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The URL regex is very strict and will reject common valid git remote formats like ssh://git@github.com/owner/repo(.git) or a trailing slash. If contributors use those remote URL styles, the script will now fail even though the repo is legitimate. Consider normalizing additional git remote URL formats to the canonical https URL before validation, or extending the validation to accept those equivalent forms.

Copilot uses AI. Check for mistakes.

$filename = "release_${VersionFrom}_to_${VersionTo}.md"

# Clear existing release.md if it exists
Expand Down Expand Up @@ -68,8 +75,11 @@ foreach ($sha in $commits) {
$message = git log -1 --pretty=format:'%s' $sha
$shortSha = git log -1 --pretty=format:'%h' $sha | ForEach-Object { $_.Substring(0, 6) }

# Escape markdown special characters in commit message to prevent content injection
$safemessage = $message -replace '\[', '\[' -replace '\]', '\]' -replace '<', '&lt;' -replace '>', '&gt;'
Comment on lines +78 to +79
Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Escaping </> without escaping & first can be bypassed by a commit subject containing pre-escaped entities like &lt;script&gt;.... Consider performing proper HTML escaping (escape & before </>, or use a built-in HTML encoder) before writing the message into markdown.

Suggested change
# Escape markdown special characters in commit message to prevent content injection
$safemessage = $message -replace '\[', '\[' -replace '\]', '\]' -replace '<', '&lt;' -replace '>', '&gt;'
# Escape HTML first, then escape markdown link delimiters in the commit message to prevent content injection
$safemessage = [System.Net.WebUtility]::HtmlEncode($message) -replace '\[', '\[' -replace '\]', '\]'

Copilot uses AI. Check for mistakes.

# Add commit line to release.md
Add-Content -Path $filename -Value "- [``$shortSha``]($repoUrl/commit/$sha) — $message by @$username"
Add-Content -Path $filename -Value "- [``$shortSha``]($repoUrl/commit/$sha) — $safemessage by @$username"
Comment on lines +79 to +82
Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Variable name $safemessage is inconsistent with the casing used elsewhere in this script (e.g., $repoUrl, $shortSha). Consider renaming to $safeMessage for readability and consistency.

Copilot uses AI. Check for mistakes.
}

Write-Host "Release notes generated successfully in $filename"
Expand Down
Loading