feat: enhance validation for user inputs and improve error handling across scripts

locus313 · locus313 · commit d7e0c44837ee · 2026-06-21T12:01:21.000-07:00
diff --git a/README.md b/README.md
@@ -80,7 +80,7 @@ Scripts use environment variables for configuration. Common variables include:
 | `GITHUB_TOKEN` | GitHub personal access token | Yes |
 | `ORG` | Organization name | Yes (most scripts) |
 | `API_URL_PREFIX` | GitHub API base URL (default: `https://api.github.com`) | No |
-| `GIT_URL_PREFIX` | GitHub base URL (default: `https://github.com`) | No |
+| `GIT_URL_PREFIX` | GitHub base URL (default: `https://github.com`). Must be a GitHub-family host (`github.com`, `*.github.com`, `*.ghe.com`, `*.githubenterprise.com`). | No |
 
 > [!NOTE]
 > The `*_PREFIX` variables support GitHub Enterprise Server. Set them to your enterprise domain to use these scripts with GHES.
@@ -200,6 +200,9 @@ cd org-admin/github-repo-from-template
 - Assigns write permissions to teams in `REPO_WRITE`
 - Invites CD user as collaborator and auto-accepts the invitation
 
+> [!NOTE]
+> `REPO_NAME` (CLI argument), `TEMPLATE_REPO`, `CD_USERNAME`, and all team slugs in `REPO_ADMIN` and `REPO_WRITE` are validated as slugs before use. Only alphanumeric characters, hyphens, and underscores are accepted.
+
 ---
 
 ### Import Repository
@@ -231,6 +234,9 @@ cd org-admin/github-import-repo
 > [!WARNING]
 > This creates a complete copy with full git history. Ensure you have sufficient disk space and network bandwidth for large repositories.
 
+> [!NOTE]
+> `GIT_URL_PREFIX` is validated against a GitHub-host allowlist before any git operations run. Non-GitHub URLs are rejected to prevent credential leakage. Repository names and `OWNER_USERNAME` must be valid slugs (alphanumeric, hyphen, and underscore only).
+
 ---
 
 ### Add Repository Collaborators by Pattern
@@ -331,6 +337,9 @@ cd org-admin/github-auto-repo-creation
 > [!NOTE]
 > Requires `base64` in addition to `curl` and `jq` (used to encode the CODEOWNERS file content for the API).
 
+> [!NOTE]
+> All values in `REPO_NAMES`, `ADMIN_TEAMS`, and `REPO_OWNERS` are validated as slugs — only alphanumeric characters, hyphens, and underscores are allowed. The script exits with an error if any value fails this check.
+
 ---
 
 ### Close Archived Repository Security Alerts
@@ -691,6 +700,9 @@ cd enterprise/github-dockerfile-discovery
 > [!NOTE]
 > Code search is heavily rate-limited. Increase `SEARCH_SLEEP` and `CONTENT_SLEEP` if you encounter `403` responses.
 
+> [!NOTE]
+> `ORG_FILTER` and `ORG_EXCLUDE` are validated as syntactically correct ERE patterns before use. An invalid regex causes the script to exit immediately with an error rather than silently bypassing the filter.
+
 ---
 
 ### Get Public Repositories
@@ -724,6 +736,9 @@ cd enterprise/github-get-public-repos
 | `ORG_FILTER` | ERE regex to keep only matching org names | — |
 | `ORG_EXCLUDE` | ERE regex to drop matching org names | — |
 
+> [!NOTE]
+> `ORG_FILTER` and `ORG_EXCLUDE` are validated as syntactically correct ERE patterns before use. An invalid regex causes the script to exit immediately with an error rather than silently bypassing the filter.
+
 ---
 
 ### Organize Starred Repositories
diff --git a/enterprise/github-dockerfile-discovery/github-dockerfile-discovery.sh b/enterprise/github-dockerfile-discovery/github-dockerfile-discovery.sh
@@ -592,6 +592,12 @@ main() {
 
 # ── Apply ORG_FILTER (inclusion) if set ────────────────────────────────
   if [ -n "${ORG_FILTER}" ]; then
+    local _rc=0
+    echo "" | grep -qE "${ORG_FILTER}" 2>/dev/null || _rc=$?
+    if [ "${_rc}" -eq 2 ]; then
+      print_error "ORG_FILTER is not a valid ERE regex: ${ORG_FILTER}"
+      exit 1
+    fi
     local filtered=()
     for org in "${orgs[@]}"; do
       if echo "${org}" | grep -qE "${ORG_FILTER}"; then
@@ -605,6 +611,12 @@ main() {
 
   # ── Apply ORG_EXCLUDE (exclusion) if set ────────────────────────────────
   if [ -n "${ORG_EXCLUDE}" ]; then
+    local _rc=0
+    echo "" | grep -qE "${ORG_EXCLUDE}" 2>/dev/null || _rc=$?
+    if [ "${_rc}" -eq 2 ]; then
+      print_error "ORG_EXCLUDE is not a valid ERE regex: ${ORG_EXCLUDE}"
+      exit 1
+    fi
     local kept=()
     for org in "${orgs[@]}"; do
       if ! echo "${org}" | grep -qE "${ORG_EXCLUDE}"; then
diff --git a/enterprise/github-get-public-repos/github-get-public-repos.sh b/enterprise/github-get-public-repos/github-get-public-repos.sh
@@ -256,11 +256,23 @@ resolve_orgs() {
 
   # Apply ORG_FILTER include regex
   if [ -n "${ORG_FILTER}" ]; then
+    local _rc=0
+    echo "" | grep -qE "${ORG_FILTER}" 2>/dev/null || _rc=$?
+    if [ "${_rc}" -eq 2 ]; then
+      print_error "ORG_FILTER is not a valid ERE regex: ${ORG_FILTER}"
+      exit 1
+    fi
     raw_orgs=$(echo "${raw_orgs}" | grep -E "${ORG_FILTER}" || true)
   fi
 
   # Apply ORG_EXCLUDE regex
   if [ -n "${ORG_EXCLUDE}" ]; then
+    local _rc=0
+    echo "" | grep -qE "${ORG_EXCLUDE}" 2>/dev/null || _rc=$?
+    if [ "${_rc}" -eq 2 ]; then
+      print_error "ORG_EXCLUDE is not a valid ERE regex: ${ORG_EXCLUDE}"
+      exit 1
+    fi
     raw_orgs=$(echo "${raw_orgs}" | grep -Ev "${ORG_EXCLUDE}" || true)
   fi
 
diff --git a/org-admin/github-auto-repo-creation/github-auto-repo-creation.sh b/org-admin/github-auto-repo-creation/github-auto-repo-creation.sh
@@ -52,6 +52,17 @@ require_command base64
 require_command jq
 validate_github_token
 
+# Validate all user-supplied names before use in API URL paths
+while IFS= read -r _name; do
+  [ -n "${_name}" ] && validate_slug "${_name}" "REPO_NAMES value"
+done < <(tr ',' '\n' <<< "${REPO_NAMES}")
+while IFS= read -r _name; do
+  [ -n "${_name}" ] && validate_slug "${_name}" "ADMIN_TEAMS value"
+done < <(tr ',' '\n' <<< "${ADMIN_TEAMS:-}")
+while IFS= read -r _name; do
+  [ -n "${_name}" ] && validate_slug "${_name}" "REPO_OWNERS value"
+done < <(tr ',' '\n' <<< "${REPO_OWNERS}")
+
 # Define the content of the CODEOWNERS file
 CODEOWNERS_CONTENT=$(cat << EOF
 # Lines starting with '#' are comments.
@@ -115,6 +126,8 @@ create_codeowners_file() {
 add_teams_to_repo() {
   local repo_name=$1
   local team_name=$2
+  validate_slug "${repo_name}" "repository name"
+  validate_slug "${team_name}" "team name"
   curl -s -X PUT -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github+json" "${API_URL_PREFIX}/orgs/${ORG}/teams/${team_name}/repos/${ORG}/${repo_name}" -d "{
     \"permission\": \"admin\"
   }"
@@ -124,6 +137,8 @@ add_teams_to_repo() {
 add_repo_owners_to_repo() {
   local repo_name=$1
   local team_name=$2
+  validate_slug "${repo_name}" "repository name"
+  validate_slug "${team_name}" "team name"
   curl -s -X PUT -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github+json" "${API_URL_PREFIX}/orgs/${ORG}/teams/${team_name}/repos/${ORG}/${repo_name}" -d "{
     \"permission\": \"push\"
   }"
diff --git a/org-admin/github-get-repo-list/github-get-repo-list.sh b/org-admin/github-get-repo-list/github-get-repo-list.sh
@@ -40,7 +40,7 @@ require_command jq
 validate_github_token
 
 get_repo_pagination () {
-    repo_pages=$(curl -H "Authorization: token ${GITHUB_TOKEN}" -I "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100" | grep -Eo '&page=[0-9]+' | grep -Eo '[0-9]+' | tail -1;)
+    repo_pages=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" -I "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100" | grep -Eo '&page=[0-9]+' | grep -Eo '[0-9]+' | tail -1;)
     echo "${repo_pages:-1}"
 }
 
diff --git a/org-admin/github-import-repo/github-import-repo.sh b/org-admin/github-import-repo/github-import-repo.sh
@@ -79,6 +79,22 @@ require_command git
 require_command jq
 validate_github_token
 
+# Validate GIT_URL_PREFIX is a recognised GitHub host to prevent credential leakage
+# via GIT_ASKPASS, which provides GITHUB_TOKEN to any host git connects to
+case "${GIT_URL_PREFIX}" in
+  https://github.com|https://*.github.com|https://*.ghe.com|https://*.githubenterprise.com)
+    ;;
+  *)
+    print_error "GIT_URL_PREFIX '${GIT_URL_PREFIX}' is not a recognised GitHub host. \
+Refusing to run git operations that would expose GITHUB_TOKEN to an unverified host."
+    exit 1
+    ;;
+esac
+
+validate_slug "${SRC_REPO}"       "source repository name"
+validate_slug "${DEST_REPO}"      "destination repository name"
+validate_slug "${OWNER_USERNAME}" "owner username"
+
 # Create repo
 _payload=$(jq -n --arg name "${DEST_REPO}" '{"name":$name,"visibility":"internal"}')
 CREATE_RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github+json" "${API_URL_PREFIX}/orgs/${ORG}/repos" -d "${_payload}")
diff --git a/org-admin/github-repo-from-template/github-repo-from-template.sh b/org-admin/github-repo-from-template/github-repo-from-template.sh
@@ -71,6 +71,10 @@ validate_github_token
 require_env_var CD_GITHUB_TOKEN "CD GitHub token"
 validate_token CD_GITHUB_TOKEN
 
+validate_slug "${REPO_NAME}"     "repository name"
+validate_slug "${TEMPLATE_REPO}" "template repository name"
+validate_slug "${CD_USERNAME}"   "CD username"
+
 # Create repo from template
 _payload=$(jq -n --arg name "${REPO_NAME}" --arg owner "${ORG}" \
   '{"name":$name,"owner":$owner,"private":true,"include_all_branches":true}')
@@ -83,6 +87,7 @@ fi
 
 # Give internal teams permissions on the new repo
 for ADMIN_TEAM in ${REPO_ADMIN}; do
+  validate_slug "${ADMIN_TEAM}" "REPO_ADMIN team"
   ADMIN_RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" -X PUT -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github.v3+json" "${API_URL_PREFIX}/orgs/${ORG}/teams/${ADMIN_TEAM}/repos/${ORG}/${REPO_NAME}" -d '{"permission":"admin"}')
 
   if [ "${ADMIN_RESPONSE}" -ne 204 ]; then
@@ -94,6 +99,7 @@ for ADMIN_TEAM in ${REPO_ADMIN}; do
 done
 
 for WRITE_TEAM in ${REPO_WRITE}; do
+  validate_slug "${WRITE_TEAM}" "REPO_WRITE team"
   WRITE_RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" -X PUT -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github.v3+json" "${API_URL_PREFIX}/orgs/${ORG}/teams/${WRITE_TEAM}/repos/${ORG}/${REPO_NAME}" -d '{"permission":"push"}')
 
   if [ "${WRITE_RESPONSE}" -ne 204 ]; then
diff --git a/personal/github-organize-stars/github-organize-stars.sh b/personal/github-organize-stars/github-organize-stars.sh
@@ -242,7 +242,9 @@ if [[ -f "$CACHE_FILE" ]]; then
 else
   echo "Fetching your starred repos..."
   mkdir -p "$(dirname "$CACHE_FILE")"
+  chmod 700 "$(dirname "$CACHE_FILE")"
   fetch_stars > "$CACHE_FILE"
+  chmod 600 "$CACHE_FILE"
 fi
 
 TOTAL=$(jq 'length' "$CACHE_FILE")
diff --git a/reporting/github-monthly-issues-report/github-monthly-issues-report.sh b/reporting/github-monthly-issues-report/github-monthly-issues-report.sh
@@ -78,7 +78,8 @@ limit_issue_pagination () {
 
 repo_issues () {
   for PAGE in $(limit_issue_pagination); do
-    for i in $(curl -s -H "Authorization: token ${GITHUB_TOKEN}" "${API_URL_PREFIX}/repos/${ORG}/${REPO}/issues?state=all&labels=Linked%20[AC]&page=${PAGE}&per_page=100" | jq -r --arg s "${MONTH_START}" --arg e "${MONTH_END}" 'map(select(.created_at | . >= ($s+"T00:00") and . <= ($e+"T23:59"))) | sort_by(.number) | .[].number'); do
+    while IFS= read -r i; do
+      [ -z "${i}" ] && continue
       ISSUE_PAYLOAD=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" "${API_URL_PREFIX}/repos/${ORG}/${REPO}/issues/${i}" -H "Accept: application/vnd.github.mercy-preview+json")
       ISSUE_TIMELINE_PAYLOAD=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" "${API_URL_PREFIX}/repos/${ORG}/${REPO}/issues/${i}/timeline" -H "Accept: application/vnd.github.mockingbird-preview+json" | jq -r '.[] | select(.label.name=="Linked [AC]" or .label.name=="linked")')
       
@@ -95,7 +96,7 @@ repo_issues () {
         --arg contrib "${ISSUE_TIMELINE_LABELED_BY}" \
         '{"author":$author,"title":$title,"issue_url":$url,"contributor":$contrib}' \
         >> "${ISSUES_TEMP}"
-    done
+    done < <(curl -s -H "Authorization: token ${GITHUB_TOKEN}" "${API_URL_PREFIX}/repos/${ORG}/${REPO}/issues?state=all&labels=Linked%20[AC]&page=${PAGE}&per_page=100" | jq -r --arg s "${MONTH_START}" --arg e "${MONTH_END}" 'map(select(.created_at | . >= ($s+"T00:00") and . <= ($e+"T23:59"))) | sort_by(.number) | .[].number')
   done
 }
 
@@ -105,7 +106,6 @@ author_json () {
     TEST_PAYLOAD=$(cat "${ISSUES_TEMP}" | jq -r '.author' | sort | uniq -c | awk -F " " '{print "{\"author\":""\""\ $2"\""",\"count\":" $1"}"}' | jq -r .)
     TEST_PAYLOAD_AUTHOR=$(echo "${TEST_PAYLOAD}" | jq -r --arg AUTHOR "${AUTHOR}" 'select(.author==$AUTHOR) | .author')
     TEST_PAYLOAD_AUTHOR_COUNT=$(echo "${TEST_PAYLOAD}" | jq -r --arg AUTHOR "${AUTHOR}" 'select(.author==$AUTHOR) | .count')
-    TEST_PAYLOAD_AUTHOR_ISSUE_URL=$(cat "${ISSUES_TEMP}" | jq -r --arg AUTHOR "${AUTHOR}" 'select(.author==$AUTHOR) | .title, .issue_url')
     echo -e "<a href=\"https://github.com/${TEST_PAYLOAD_AUTHOR}\">${TEST_PAYLOAD_AUTHOR}</a> - ${TEST_PAYLOAD_AUTHOR_COUNT}"
   done | sort -n -k 4,4 -r >> "${OUTPUT_FILE}"
 }
@@ -116,7 +116,6 @@ contributor_json () {
     TEST_PAYLOAD=$(cat "${ISSUES_TEMP}" | jq -r '.contributor' | sort | uniq -c | awk -F " " '{print "{\"contributor\":""\""\ $2"\""",\"count\":" $1"}"}' | jq -r .)
     TEST_PAYLOAD_CONTRIBUTOR=$(echo "${TEST_PAYLOAD}" | jq -r --arg CONTRIBUTOR "${CONTRIBUTOR}" 'select(.contributor==$CONTRIBUTOR) | .contributor')
     TEST_PAYLOAD_CONTRIBUTOR_COUNT=$(echo "${TEST_PAYLOAD}" | jq -r --arg CONTRIBUTOR "${CONTRIBUTOR}" 'select(.contributor==$CONTRIBUTOR) | .count')
-    TEST_PAYLOAD_CONTRIBUTOR_ISSUE_URL=$(cat "${ISSUES_TEMP}" | jq -r --arg CONTRIBUTOR "${CONTRIBUTOR}" 'select(.contributor==$CONTRIBUTOR) | .issue_url')
     echo -e "<a href=\"https://github.com/${TEST_PAYLOAD_CONTRIBUTOR}\">${TEST_PAYLOAD_CONTRIBUTOR}</a> - ${TEST_PAYLOAD_CONTRIBUTOR_COUNT}"
   done | sort -n -k 4,4 -r >> "${OUTPUT_FILE}"
 }

Original file line number	Diff line number	Diff line change
`@@ -40,7 +40,7 @@ require_command jq`
`40`	`40`	`validate_github_token`
`41`	`41`
`42`	`42`	`get_repo_pagination () {`
`43`		`- repo_pages=$(curl -H "Authorization: token ${GITHUB_TOKEN}" -I "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100" \| grep -Eo '&page=[0-9]+' \| grep -Eo '[0-9]+' \| tail -1;)`
	`43`	`+ repo_pages=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" -I "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100" \| grep -Eo '&page=[0-9]+' \| grep -Eo '[0-9]+' \| tail -1;)`
`44`	`44`	`echo "${repo_pages:-1}"`
`45`	`45`	`}`
`46`	`46`