fix(security): percent-encode API query parameters to prevent injection#2301
Draft
cursor[bot] wants to merge 2 commits into
Draft
fix(security): percent-encode API query parameters to prevent injection#2301cursor[bot] wants to merge 2 commits into
cursor[bot] wants to merge 2 commits into
Conversation
HTTP and SSE API providers concatenated query parameter values directly into URLs without encoding. Attacker-controlled values containing & or = could inject additional query parameters, enabling parameter pollution attacks against backend APIs. Use Uri.replace(queryParameters:) via appendEncodedQueryParameters() to properly encode keys and values. Adds regression tests. Co-authored-by: Sharjeel Yunus <sharjeelyunus@users.noreply.github.com>
Co-authored-by: Sharjeel Yunus <sharjeelyunus@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability summary
HTTP and SSE API providers built GET/DELETE URLs by concatenating query parameter keys and values without percent-encoding. Attacker-controlled parameter values containing
&or=could inject additional query parameters (parameter pollution).Affected location
modules/ensemble/lib/framework/apiproviders/http_api_provider.dartmodules/ensemble/lib/framework/apiproviders/sse_api_provider.dartSecurity impact
Medium — An attacker who controls input that flows into API
parameters(e.g., via${userInput}in YAML) can append extra query parameters to outbound requests. This can bypass server-side filters, escalate privileges, or alter API behavior when backends use inconsistent parameter precedence.Attack path
foo&role=admininvokeAPIGET parameter via expression evaluation?q=foo&role=admin&limit=10instead of encoding the valuerole=adminparameterFix approach
Introduce
appendEncodedQueryParameters()usingUri.replace(queryParameters:)to merge and encode all query parameters safely.Tests
modules/ensemble/test/api_query_param_security_test.dartwith regression tests for value injection, key injection, and merging with existing URL parameters.