fix(security): encode Address widget Places proxy query parameters

User-controlled autocomplete input was interpolated into a raw URL
string, allowing attackers to inject extra query parameters (for example
to override country filters). Build proxy URLs with Uri.https and add
regression tests.

Co-authored-by: Sharjeel Yunus <sharjeelyunus@users.noreply.github.com>

Author: cursoragent

modules/ensemble/lib/widget/address.dart

@@ -12,6 +12,7 @@ import 'package:ensemble_ts_interpreter/invokables/invokable.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter/scheduler.dart';
 import 'package:get_it/get_it.dart';
+import 'package:ensemble/widget/address_url_builder.dart';
 import 'package:http/http.dart' as http;
 
 class Address extends StatefulWidget
@@ -103,22 +104,13 @@ class AddressState extends EWidgetState<Address> {
             latitude: widget._controller.getLastLocation()!.latitude,
             longitude: widget._controller.getLastLocation()!.longitude);
       }
-      String locationBiasStr = '';
-      if (center != null) {
-        locationBiasStr =
-            '&locationbias=circle:${widget._controller.proximitySearchRadius ?? 20000}@${center.latitude},${center.longitude}';
-      }
-
-      // filter by country
-      String countryFilterStr = '';
-      if (widget._controller._countryFilter?.isNotEmpty ?? false) {
-        countryFilterStr =
-            '&components=${widget._controller._countryFilter!.map((e) => 'country:$e').join('|')}';
-      }
-
-      var url =
-          'https://services-googleplacesautocomplete-2czdl2akpq-uc.a.run.app?input=$query$locationBiasStr$countryFilterStr';
-      var response = await http.get(Uri.parse(url));
+      final uri = buildPlacesAutocompleteUri(
+        input: query,
+        center: center,
+        proximityRadiusMeters: widget._controller.proximitySearchRadius,
+        countryFilter: widget._controller._countryFilter,
+      );
+      var response = await http.get(uri);
       if (response.statusCode == 200) {
         var jsonResponse = json.decode(response.body);
         if (jsonResponse['error_message'] != null) {
@@ -137,9 +129,7 @@ class AddressState extends EWidgetState<Address> {
   }
 
   Future<Place> _getPlaceDetail(PlaceSummary placeSummary) async {
-    var url =
-        'https://services-googleplacesdetail-2czdl2akpq-uc.a.run.app?placeId=${placeSummary.placeId}';
-    var response = await http.get(Uri.parse(url));
+    var response = await http.get(buildPlacesDetailUri(placeSummary.placeId));
     if (response.statusCode == 200) {
       var jsonResponse = json.decode(response.body);
       if (jsonResponse['error_message'] == null) {

modules/ensemble/lib/widget/address_url_builder.dart

@@ -0,0 +1,35 @@
+import 'package:ensemble/framework/stub/location_manager.dart';
+import 'package:meta/meta.dart';
+
+const _placesAutocompleteHost =
+    'services-googleplacesautocomplete-2czdl2akpq-uc.a.run.app';
+const _placesDetailHost =
+    'services-googleplacesdetail-2czdl2akpq-uc.a.run.app';
+
+/// Builds the Google Places autocomplete proxy URL with encoded query parameters
+/// so user-controlled [input] cannot inject additional `&key=value` pairs.
+@visibleForTesting
+Uri buildPlacesAutocompleteUri({
+  required String input,
+  LocationData? center,
+  int? proximityRadiusMeters,
+  List<String>? countryFilter,
+}) {
+  final queryParameters = <String, String>{'input': input};
+  if (center != null) {
+    final radius = proximityRadiusMeters ?? 20000;
+    queryParameters['locationbias'] =
+        'circle:$radius@${center.latitude},${center.longitude}';
+  }
+  if (countryFilter != null && countryFilter.isNotEmpty) {
+    queryParameters['components'] =
+        countryFilter.map((code) => 'country:$code').join('|');
+  }
+  return Uri.https(_placesAutocompleteHost, '/', queryParameters);
+}
+
+/// Builds the Google Places detail proxy URL with an encoded [placeId].
+@visibleForTesting
+Uri buildPlacesDetailUri(String placeId) {
+  return Uri.https(_placesDetailHost, '/', {'placeId': placeId});
+}

modules/ensemble/test/address_url_security_test.dart

@@ -0,0 +1,42 @@
+import 'package:ensemble/framework/stub/location_manager.dart';
+import 'package:ensemble/widget/address_url_builder.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  group('buildPlacesAutocompleteUri', () {
+    test('percent-encodes user input so extra query params cannot be injected',
+        () {
+      const maliciousInput = 'foo&components=country:US';
+      final uri = buildPlacesAutocompleteUri(
+        input: maliciousInput,
+        countryFilter: const ['CA'],
+      );
+
+      expect(uri.queryParameters['input'], maliciousInput);
+      expect(uri.queryParameters['components'], 'country:CA');
+      expect(uri.queryParameters.containsKey('country:US'), isFalse);
+      expect(uri.query, contains('input=foo%26components%3Dcountry%3AUS'));
+    });
+
+    test('includes location bias when center is provided', () {
+      final uri = buildPlacesAutocompleteUri(
+        input: 'Paris',
+        center: LocationData(latitude: 48.8566, longitude: 2.3522),
+        proximityRadiusMeters: 15000,
+      );
+
+      expect(uri.queryParameters['locationbias'],
+          'circle:15000@48.8566,2.3522');
+    });
+  });
+
+  group('buildPlacesDetailUri', () {
+    test('encodes placeId query value', () {
+      const placeId = 'id&injected=1';
+      final uri = buildPlacesDetailUri(placeId);
+
+      expect(uri.queryParameters['placeId'], placeId);
+      expect(uri.query, contains('placeId=id%26injected%3D1'));
+    });
+  });
+}