fix: harden URL encoding and input validation for AI/LLM callers - #21

Merged

jpoehnelt merged 13 commits into

mainfrom

fix/encoding-url

Mar 4, 2026

Commits on Mar 4, 2026

refactor: replace manual urlencoded() with reqwest .query() builder

jpoehnelt-bot
authored and
jpoehnelt
committed
59427e7
fix: percent-encode path parameters to prevent path traversal

jpoehnelt-bot
authored and
jpoehnelt
committed
69ff727
fix: add shared URL safety helpers for path params

jpoehnelt-bot
authored and
jpoehnelt
committed
ee46264
test: add AI edge case tests for URL safety helpers

jpoehnelt-bot
authored and
jpoehnelt
committed
d5f82ac
fix: warn on stderr when API calls fail silently

jpoehnelt-bot
authored and
jpoehnelt
committed
0d438bc
fix: harden input validation for AI/LLM callers

jpoehnelt-bot
authored and
jpoehnelt
committed
96a1efd
chore: add changesets for PR #21 commits

jpoehnelt-bot
authored and
jpoehnelt
committed
20ccde1
test: add comprehensive test coverage for input validation handlers

jpoehnelt-bot
authored and
jpoehnelt
committed
54baa57
docs: document input validation and URL safety patterns in AGENTS.md and CONTRIBUTING.md

jpoehnelt-bot
authored and
jpoehnelt
committed
5cfd9be
fix: address PR review comments — reject ?/# in resource names, validate subscription arg, remove redundant validate_msg_format

jpoehnelt-bot
authored and
jpoehnelt
committed
3af3762
fix: store validated PathBuf, remove dead code, delete duplicate SubscribeConfig

jpoehnelt-bot
authored and
jpoehnelt
committed
94a0ba2
fix: per-segment traversal check in validate_resource_name, fix docs

jpoehnelt-bot
authored and
jpoehnelt
committed
35e3307
fix: harden security validation and deduplicate logic
jpoehnelt
committed
494bfb4

Navigation Menu

Uh oh!

fix: harden URL encoding and input validation for AI/LLM callers - #21

fix: harden URL encoding and input validation for AI/LLM callers#21
jpoehnelt merged 13 commits into
mainfrom
fix/encoding-url

Commits on Mar 4, 2026

refactor: replace manual urlencoded() with reqwest .query() builder

fix: percent-encode path parameters to prevent path traversal

fix: add shared URL safety helpers for path params

test: add AI edge case tests for URL safety helpers

fix: warn on stderr when API calls fail silently

fix: harden input validation for AI/LLM callers

chore: add changesets for PR #21 commits

test: add comprehensive test coverage for input validation handlers

docs: document input validation and URL safety patterns in AGENTS.md and CONTRIBUTING.md

fix: address PR review comments — reject ?/# in resource names, validate subscription arg, remove redundant validate_msg_format

fix: store validated PathBuf, remove dead code, delete duplicate SubscribeConfig

fix: per-segment traversal check in validate_resource_name, fix docs

fix: harden security validation and deduplicate logic