Fix URL parameter injection in shared graph URL handling

restrict share id regex to prevent injection of arbitrary query parameters.

Author: sebastianrath

actrun.sh

@@ -61,7 +61,7 @@ if [ -x "$CACHED_BINARY" ]; then
     echo "✅ Using cached actrun $VERSION"
 
     # Process shared URL if first argument matches the pattern
-    if [ $# -gt 0 ] && [[ "$1" =~ ^https://app\.actionforge\.dev/shared/(.+\.act)$ ]]; then
+    if [ $# -gt 0 ] && [[ "$1" =~ ^https://app\.actionforge\.dev/shared/([a-zA-Z0-9_-]+\.act)$ ]]; then
         share_id="${BASH_REMATCH[1]}"
         echo "🔗 Fetching shared graph: $share_id"
 
@@ -134,7 +134,7 @@ chmod +x "$CACHED_BINARY"
 echo "✅ Unpacked actrun $VERSION"
 
 # Process shared URL if first argument matches the pattern
-if [ $# -gt 0 ] && [[ "$1" =~ ^https://app\.actionforge\.dev/shared/(.+\.act)$ ]]; then
+if [ $# -gt 0 ] && [[ "$1" =~ ^https://app\.actionforge\.dev/shared/([a-zA-Z0-9_-]+\.act)$ ]]; then
     share_id="${BASH_REMATCH[1]}"
     echo "🔗 Fetching shared graph: $share_id"
 

core/graph.go

@@ -1049,7 +1049,7 @@ var sharedURLPattern = regexp.MustCompile(`^https://app\.actionforge\.dev/shared
 const shareAPIURL = "https://app.actionforge.dev/api/v2/share/graph/read"
 
 func IsSharedGraphURL(graphURL string) bool {
-	return strings.HasPrefix(graphURL, "https://")
+	return sharedURLPattern.MatchString(graphURL)
 }
 
 func ParseSharedGraphURL(graphURL string) (string, bool) {