fix(api): encode interpolated path segments in API client - #1218
Open
geoffg-sentry wants to merge 3 commits into
Open
fix(api): encode interpolated path segments in API client#1218geoffg-sentry wants to merge 3 commits into
geoffg-sentry wants to merge 3 commits into
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit e358764. Configure here.
fix it:
geoffg-sentry
force-pushed
the
geoffg-sentry/harden-profileId
branch
from
July 31, 2026 13:37
e358764 to
a463489
Compare
Jeffreyhung
approved these changes
Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resource IDs were interpolated into upstream REST paths unencoded, and
fetchresolves../dot segments during URL parsing. Hardening this.Added an
apiPathtagged template and converted all 76 request paths inclient.tsto use it. It percent-encodes each interpolated value so it cannot introduce new path segments, and rejects a value that is entirely a dot segment: encoding cannot neutralize those, because the URL spec treats..and its percent-encoded spellings alike. Redundant manualencodeURIComponentcalls were removed to avoid double-encoding.Added a shared
validateResourceIdrefinement to the affected ID parameters (eventId,attachmentId,replayId,profileId,keyId) so callers get a validation error instead of a confusing upstream 404. Also applied the existingvalidateSlugOrIdtoprojectSlugOrIdon the two profile tools, which had skipped it.Added a test that fails on any future request path built without
apiPath. The previous fix for this class hardened the parameters vulnerable at the time and left the IDs raw, so enforcing the invariant matters more than enumerating parameters.Corrected
docs/specs/subpath-constraints.md, which incorrectly stated that clients can override the injected org/project per call.added
.pnpm-store/to.gitignoremostly so I don't make a mistake laterShouldn't break a thing. Encoding is a no-op for any legitimate slug character set.