fix(infra): validate file-sourced data before outbound network requests

Sanitize cluster_id path segments in weaviate.ts and validate URLs
in status.ts before making network requests with file-sourced data.

Fixes code-scanning #10, #11

Generated with oh-my-agent

Co-Authored-By: First Fluke <our.first.fluke@gmail.com>

Author: gracefullight

apps/infra/freemium/scripts/status.ts

@@ -7,6 +7,14 @@ const HACKATHON_DIR = join(__dirname, "..");
 const STATE_FILE = join(HACKATHON_DIR, ".weaviate-state.json");
 const TIMEOUT_MS = 5_000;
 
+function validateUrl(value: string, name: string): string {
+  const parsed = URL.parse(value);
+  if (!parsed || !["http:", "https:"].includes(parsed.protocol ?? "")) {
+    throw new Error(`Invalid ${name} URL: ${value}`);
+  }
+  return parsed.href;
+}
+
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
@@ -119,7 +127,7 @@ async function checkVercelProject(
   projectId: string,
   token: string,
 ): Promise<{ ok: boolean; error?: string }> {
-  const url = `https://api.vercel.com/v9/projects/${projectId}`;
+  const url = validateUrl(`https://api.vercel.com/v9/projects/${encodeURIComponent(projectId)}`, "Vercel API");
   try {
     const res = await fetchWithTimeout(url, {
       headers: { Authorization: `Bearer ${token}` },
@@ -134,7 +142,7 @@ async function checkVercelProject(
 async function checkSupabase(
   projectId: string,
 ): Promise<{ ok: boolean; error?: string }> {
-  const url = `https://${projectId}.supabase.co`;
+  const url = validateUrl(`https://${encodeURIComponent(projectId)}.supabase.co`, "Supabase");
   try {
     const res = await fetchWithTimeout(url);
     if (res.status < 500) return { ok: true };
@@ -147,7 +155,7 @@ async function checkSupabase(
 async function checkWeaviate(
   weaviateUrl: string,
 ): Promise<{ ok: boolean; error?: string }> {
-  const base = weaviateUrl.replace(/\/$/, "");
+  const base = validateUrl(weaviateUrl, "Weaviate").replace(/\/$/, "");
   const url = `${base}/.well-known/ready`;
   try {
     const res = await fetchWithTimeout(url);

apps/infra/freemium/scripts/weaviate.ts

@@ -7,6 +7,14 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const STATE_FILE = join(__dirname, "..", ".weaviate-state.json");
 const WCD_BASE_URL = "https://api.wcs.weaviate.io/v1";
 
+function validatePathSegment(value: string, name: string): string {
+  const sanitized = encodeURIComponent(value);
+  if (!sanitized || sanitized.includes("..") || sanitized.includes("/")) {
+    throw new Error(`Invalid ${name}: ${value}`);
+  }
+  return sanitized;
+}
+
 interface WeaviateState {
   cluster_id: string;
   url: string;
@@ -106,7 +114,7 @@ async function commandUp(apiKey: string, clusterName: string): Promise<void> {
   if (state?.cluster_id) {
     const check = await apiRequest<unknown>(
       "GET",
-      `/clusters/${state.cluster_id}`,
+      `/clusters/${validatePathSegment(state.cluster_id, "cluster_id")}`,
       apiKey,
     );
 
@@ -163,7 +171,7 @@ async function commandDown(apiKey: string): Promise<void> {
 
   const del = await apiRequest<unknown>(
     "DELETE",
-    `/clusters/${state.cluster_id}`,
+    `/clusters/${validatePathSegment(state.cluster_id, "cluster_id")}`,
     apiKey,
   );
 
@@ -191,7 +199,7 @@ async function commandStatus(apiKey: string): Promise<void> {
 
   const result = await apiRequest<unknown>(
     "GET",
-    `/clusters/${state.cluster_id}`,
+    `/clusters/${validatePathSegment(state.cluster_id, "cluster_id")}`,
     apiKey,
   );