fix(middleware): HTML escape path parameters

router/middleware/build/build.go

@@ -6,18 +6,17 @@ package build
 
 import (
 	"fmt"
+	"html"
 	"net/http"
 	"strconv"
 
-	"github.com/go-vela/server/router/middleware/org"
-	"github.com/go-vela/server/router/middleware/user"
-
+	"github.com/gin-gonic/gin"
 	"github.com/go-vela/server/database"
+	"github.com/go-vela/server/router/middleware/org"
 	"github.com/go-vela/server/router/middleware/repo"
+	"github.com/go-vela/server/router/middleware/user"
 	"github.com/go-vela/server/util"
 	"github.com/go-vela/types/library"
-
-	"github.com/gin-gonic/gin"
 	"github.com/sirupsen/logrus"
 )
 
@@ -34,13 +33,13 @@ func Establish() gin.HandlerFunc {
 		u := user.Retrieve(c)
 
 		if r == nil {
-			retErr := fmt.Errorf("repo %s/%s not found", c.Param("org"), c.Param("repo"))
+			retErr := fmt.Errorf("repo %s/%s not found", html.EscapeString(c.Param("org")), html.EscapeString(c.Param("repo")))
 			util.HandleError(c, http.StatusNotFound, retErr)
 
 			return
 		}
 
-		bParam := c.Param("build")
+		bParam := html.EscapeString(c.Param("build"))
 		if len(bParam) == 0 {
 			retErr := fmt.Errorf("no build parameter provided")
 			util.HandleError(c, http.StatusBadRequest, retErr)

router/middleware/executors/executors.go

@@ -7,19 +7,16 @@ package executors
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"io/ioutil"
+	"net/http"
 	"time"
 
-	"github.com/go-vela/types/library"
-
+	"github.com/gin-gonic/gin"
 	"github.com/go-vela/server/database"
 	"github.com/go-vela/server/router/middleware/build"
 	"github.com/go-vela/server/util"
-
-	"fmt"
-	"net/http"
-
-	"github.com/gin-gonic/gin"
+	"github.com/go-vela/types/library"
 )
 
 // Retrieve gets the executors in the given context.

router/middleware/org/org.go

@@ -5,12 +5,12 @@
 package org
 
 import (
-	"github.com/go-vela/server/util"
-
 	"fmt"
+	"html"
 	"net/http"
 
 	"github.com/gin-gonic/gin"
+	"github.com/go-vela/server/util"
 )
 
 // Retrieve gets the org in the given context.
@@ -21,7 +21,7 @@ func Retrieve(c *gin.Context) string {
 // Establish used to check if org param is used only.
 func Establish() gin.HandlerFunc {
 	return func(c *gin.Context) {
-		oParam := c.Param("org")
+		oParam := html.EscapeString(c.Param("org"))
 		if len(oParam) == 0 {
 			retErr := fmt.Errorf("no org parameter provided")
 			util.HandleError(c, http.StatusBadRequest, retErr)
@@ -30,6 +30,7 @@ func Establish() gin.HandlerFunc {
 		}
 
 		ToContext(c, oParam)
+
 		c.Next()
 	}
 }

router/middleware/perm/perm.go

@@ -6,20 +6,19 @@ package perm
 
 import (
 	"fmt"
+	"html"
 	"net/http"
 	"strings"
 
+	"github.com/gin-gonic/gin"
 	"github.com/go-vela/server/database"
 	"github.com/go-vela/server/router/middleware/org"
 	"github.com/go-vela/server/router/middleware/repo"
 	"github.com/go-vela/server/router/middleware/user"
 	"github.com/go-vela/server/scm"
 	"github.com/go-vela/server/util"
-
 	"github.com/go-vela/types/constants"
 	"github.com/go-vela/types/library"
-
-	"github.com/gin-gonic/gin"
 	"github.com/sirupsen/logrus"
 )
 
@@ -52,10 +51,10 @@ func MustPlatformAdmin() gin.HandlerFunc {
 func MustSecretAdmin() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		u := user.Retrieve(c)
-		e := c.Param("engine")
-		t := c.Param("type")
-		o := c.Param("org")
-		n := c.Param("name")
+		e := html.EscapeString(c.Param("engine"))
+		t := html.EscapeString(c.Param("type"))
+		o := html.EscapeString(c.Param("org"))
+		n := html.EscapeString(c.Param("name"))
 		m := c.Request.Method
 
 		// create log fields from API metadata

router/middleware/pipeline/pipeline.go

@@ -6,6 +6,7 @@ package pipeline
 
 import (
 	"fmt"
+	"html"
 	"net/http"
 
 	"github.com/gin-gonic/gin"
@@ -31,14 +32,14 @@ func Establish() gin.HandlerFunc {
 		u := user.Retrieve(c)
 
 		if r == nil {
-			retErr := fmt.Errorf("repo %s/%s not found", c.Param("org"), c.Param("repo"))
+			retErr := fmt.Errorf("repo %s/%s not found", html.EscapeString(c.Param("org")), html.EscapeString(c.Param("repo")))
 
 			util.HandleError(c, http.StatusNotFound, retErr)
 
 			return
 		}
 
-		p := c.Param("pipeline")
+		p := html.EscapeString(c.Param("pipeline"))
 		if len(p) == 0 {
 			retErr := fmt.Errorf("no pipeline parameter provided")
 
@@ -52,10 +53,10 @@ func Establish() gin.HandlerFunc {
 		// https://pkg.go.dev/github.com/sirupsen/logrus?tab=doc#Entry.WithFields
 		logrus.WithFields(logrus.Fields{
 			"org":      o,
-			"pipeline": p,
+			"pipeline": html.EscapeString(p),
 			"repo":     r.GetName(),
 			"user":     u.GetName(),
-		}).Debugf("reading pipeline %s/%s", r.GetFullName(), p)
+		}).Debugf("reading pipeline %s/%s", r.GetFullName(), html.EscapeString(p))
 
 		pipeline, err := database.FromContext(c).GetPipelineForRepo(p, r)
 		if err != nil {

router/middleware/repo/repo.go

@@ -5,18 +5,17 @@
 package repo
 
 import (
-	"github.com/go-vela/server/router/middleware/org"
-	"github.com/go-vela/server/router/middleware/user"
-	"github.com/go-vela/types/library"
-	"github.com/sirupsen/logrus"
-
-	"github.com/go-vela/server/database"
-	"github.com/go-vela/server/util"
-
 	"fmt"
+	"html"
 	"net/http"
 
 	"github.com/gin-gonic/gin"
+	"github.com/go-vela/server/database"
+	"github.com/go-vela/server/router/middleware/org"
+	"github.com/go-vela/server/router/middleware/user"
+	"github.com/go-vela/server/util"
+	"github.com/go-vela/types/library"
+	"github.com/sirupsen/logrus"
 )
 
 // Retrieve gets the repo in the given context.
@@ -30,7 +29,7 @@ func Establish() gin.HandlerFunc {
 		o := org.Retrieve(c)
 		u := user.Retrieve(c)
 
-		rParam := c.Param("repo")
+		rParam := html.EscapeString(c.Param("repo"))
 		if len(rParam) == 0 {
 			retErr := fmt.Errorf("no repo parameter provided")
 			util.HandleError(c, http.StatusBadRequest, retErr)

router/middleware/service/service.go

@@ -6,19 +6,18 @@ package service
 
 import (
 	"fmt"
+	"html"
 	"net/http"
 	"strconv"
 
-	"github.com/go-vela/server/router/middleware/org"
-	"github.com/go-vela/server/router/middleware/user"
-
+	"github.com/gin-gonic/gin"
 	"github.com/go-vela/server/database"
 	"github.com/go-vela/server/router/middleware/build"
+	"github.com/go-vela/server/router/middleware/org"
 	"github.com/go-vela/server/router/middleware/repo"
+	"github.com/go-vela/server/router/middleware/user"
 	"github.com/go-vela/server/util"
 	"github.com/go-vela/types/library"
-
-	"github.com/gin-gonic/gin"
 	"github.com/sirupsen/logrus"
 )
 
@@ -37,20 +36,20 @@ func Establish() gin.HandlerFunc {
 		u := user.Retrieve(c)
 
 		if r == nil {
-			retErr := fmt.Errorf("repo %s/%s not found", o, c.Param("repo"))
+			retErr := fmt.Errorf("repo %s/%s not found", o, html.EscapeString(c.Param("repo")))
 			util.HandleError(c, http.StatusNotFound, retErr)
 
 			return
 		}
 
 		if b == nil {
-			retErr := fmt.Errorf("build %s not found for repo %s", c.Param("build"), r.GetFullName())
+			retErr := fmt.Errorf("build %s not found for repo %s", html.EscapeString(c.Param("build")), r.GetFullName())
 			util.HandleError(c, http.StatusNotFound, retErr)
 
 			return
 		}
 
-		sParam := c.Param("service")
+		sParam := html.EscapeString(c.Param("service"))
 		if len(sParam) == 0 {
 			retErr := fmt.Errorf("no service parameter provided")
 			util.HandleError(c, http.StatusBadRequest, retErr)

router/middleware/step/step.go

@@ -6,19 +6,18 @@ package step
 
 import (
 	"fmt"
+	"html"
 	"net/http"
 	"strconv"
 
-	"github.com/go-vela/server/router/middleware/org"
-	"github.com/go-vela/server/router/middleware/user"
-
+	"github.com/gin-gonic/gin"
 	"github.com/go-vela/server/database"
 	"github.com/go-vela/server/router/middleware/build"
+	"github.com/go-vela/server/router/middleware/org"
 	"github.com/go-vela/server/router/middleware/repo"
+	"github.com/go-vela/server/router/middleware/user"
 	"github.com/go-vela/server/util"
 	"github.com/go-vela/types/library"
-
-	"github.com/gin-gonic/gin"
 	"github.com/sirupsen/logrus"
 )
 
@@ -37,20 +36,20 @@ func Establish() gin.HandlerFunc {
 		u := user.Retrieve(c)
 
 		if r == nil {
-			retErr := fmt.Errorf("repo %s/%s not found", o, c.Param("repo"))
+			retErr := fmt.Errorf("repo %s/%s not found", o, html.EscapeString(c.Param("repo")))
 			util.HandleError(c, http.StatusNotFound, retErr)
 
 			return
 		}
 
 		if b == nil {
-			retErr := fmt.Errorf("build %s not found for repo %s", c.Param("build"), r.GetFullName())
+			retErr := fmt.Errorf("build %s not found for repo %s", html.EscapeString(c.Param("build")), r.GetFullName())
 			util.HandleError(c, http.StatusNotFound, retErr)
 
 			return
 		}
 
-		sParam := c.Param("step")
+		sParam := html.EscapeString(c.Param("step"))
 		if len(sParam) == 0 {
 			retErr := fmt.Errorf("no step parameter provided")
 			util.HandleError(c, http.StatusBadRequest, retErr)

router/middleware/worker/worker.go

@@ -5,15 +5,14 @@
 package worker
 
 import (
-	"github.com/go-vela/server/database"
-	"github.com/go-vela/types/library"
-
-	"github.com/go-vela/server/util"
-
 	"fmt"
+	"html"
 	"net/http"
 
 	"github.com/gin-gonic/gin"
+	"github.com/go-vela/server/database"
+	"github.com/go-vela/server/util"
+	"github.com/go-vela/types/library"
 	"github.com/sirupsen/logrus"
 )
 
@@ -25,7 +24,7 @@ func Retrieve(c *gin.Context) *library.Worker {
 // Establish sets the worker in the given context.
 func Establish() gin.HandlerFunc {
 	return func(c *gin.Context) {
-		wParam := c.Param("worker")
+		wParam := html.EscapeString(c.Param("worker"))
 		if len(wParam) == 0 {
 			retErr := fmt.Errorf("no worker parameter provided")
 			util.HandleError(c, http.StatusBadRequest, retErr)