SECURITY: Unquoted curl URLs with variables in API calls #60

New issue

Closed

opened 2026-03-31 18:06:58 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-03-31 18:06:58 +00:00

Collaborator

Summary

Multiple curl API calls use variable expansions without proper quoting, which could lead to URL manipulation or injection attacks if variables contain special characters.

Locations

Several call sites in:

dev/dev-poll.sh (e.g. PR SHA lookup)
dev/phase-handler.sh (multiple locations)
Other curl calls across lib/ and dev/

Note: The specific lines need verification during implementation — the upstream report included some examples that already appear to be quoted. A quick shellcheck or grep pass for unquoted $FORGE_API / $FORGE_URL usages will identify the real offenders.

Risk

If FORGE_API or other URL variables are manipulated, could redirect API calls
Token could be exfiltrated to attacker-controlled endpoints
API responses could be spoofed

Recommended Fix

Always double-quote variable expansions in curl URLs
Validate URL variables against expected patterns before use
Consider a shared api_call wrapper in lib/env.sh that enforces quoting

References

ShellCheck SC2086 (unquoted variable)
OWASP URL Redirection prevention

Upstream: codeberg johba/disinto#819

## Summary Multiple `curl` API calls use variable expansions without proper quoting, which could lead to URL manipulation or injection attacks if variables contain special characters. ## Locations Several call sites in: - `dev/dev-poll.sh` (e.g. PR SHA lookup) - `dev/phase-handler.sh` (multiple locations) - Other `curl` calls across `lib/` and `dev/` > **Note:** The specific lines need verification during implementation — the upstream report included some examples that already appear to be quoted. A quick `shellcheck` or `grep` pass for unquoted `$FORGE_API` / `$FORGE_URL` usages will identify the real offenders. ## Risk - If `FORGE_API` or other URL variables are manipulated, could redirect API calls - Token could be exfiltrated to attacker-controlled endpoints - API responses could be spoofed ## Recommended Fix 1. Always double-quote variable expansions in `curl` URLs 2. Validate URL variables against expected patterns before use 3. Consider a shared `api_call` wrapper in `lib/env.sh` that enforces quoting ## References - ShellCheck SC2086 (unquoted variable) - OWASP URL Redirection prevention --- _Upstream: codeberg johba/disinto#819_