fix(api): HTML escape path parameters

api/authenticate.go

@@ -7,17 +7,16 @@ package api
 import (
 	"encoding/base64"
 	"fmt"
+	"html"
 	"net/http"
 
+	"github.com/gin-gonic/gin"
 	"github.com/go-vela/server/database"
 	"github.com/go-vela/server/router/middleware/token"
 	"github.com/go-vela/server/scm"
 	"github.com/go-vela/server/util"
-
 	"github.com/go-vela/types"
 	"github.com/go-vela/types/library"
-
-	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 	"github.com/sirupsen/logrus"
 )
@@ -247,8 +246,8 @@ func AuthenticateType(c *gin.Context) {
 	logrus.Info("redirecting for final auth flow destination")
 
 	// capture the path elements
-	t := c.Param("type")
-	p := c.Param("port")
+	t := html.EscapeString(c.Param("type"))
+	p := html.EscapeString(c.Param("port"))
 
 	// capture the current query parameters -
 	// they should contain the "code" and "state" values

api/deployment.go

@@ -6,20 +6,18 @@ package api
 
 import (
 	"fmt"
+	"html"
 	"net/http"
 	"strconv"
 
-	"github.com/go-vela/server/router/middleware/org"
-
+	"github.com/gin-gonic/gin"
 	"github.com/go-vela/server/database"
+	"github.com/go-vela/server/router/middleware/org"
 	"github.com/go-vela/server/router/middleware/repo"
 	"github.com/go-vela/server/router/middleware/user"
 	"github.com/go-vela/server/scm"
 	"github.com/go-vela/server/util"
-
 	"github.com/go-vela/types/library"
-
-	"github.com/gin-gonic/gin"
 	"github.com/sirupsen/logrus"
 )
 
@@ -305,7 +303,7 @@ func GetDeployment(c *gin.Context) {
 	o := org.Retrieve(c)
 	r := repo.Retrieve(c)
 	u := user.Retrieve(c)
-	deployment := c.Param("deployment")
+	deployment := html.EscapeString(c.Param("deployment"))
 
 	entry := fmt.Sprintf("%s/%s", r.GetFullName(), deployment)
 

api/hook.go

@@ -6,21 +6,19 @@ package api
 
 import (
 	"fmt"
+	"html"
 	"net/http"
 	"strconv"
 	"time"
 
+	"github.com/gin-gonic/gin"
+	"github.com/go-vela/server/database"
 	"github.com/go-vela/server/router/middleware/org"
+	"github.com/go-vela/server/router/middleware/repo"
 	"github.com/go-vela/server/router/middleware/user"
 	"github.com/go-vela/server/scm"
-
-	"github.com/go-vela/server/database"
-	"github.com/go-vela/server/router/middleware/repo"
 	"github.com/go-vela/server/util"
-
 	"github.com/go-vela/types/library"
-
-	"github.com/gin-gonic/gin"
 	"github.com/sirupsen/logrus"
 )
 
@@ -305,7 +303,7 @@ func GetHook(c *gin.Context) {
 	o := org.Retrieve(c)
 	r := repo.Retrieve(c)
 	u := user.Retrieve(c)
-	hook := c.Param("hook")
+	hook := html.EscapeString(c.Param("hook"))
 
 	entry := fmt.Sprintf("%s/%s", r.GetFullName(), hook)
 
@@ -397,7 +395,7 @@ func UpdateHook(c *gin.Context) {
 	o := org.Retrieve(c)
 	r := repo.Retrieve(c)
 	u := user.Retrieve(c)
-	hook := c.Param("hook")
+	hook := html.EscapeString(c.Param("hook"))
 
 	entry := fmt.Sprintf("%s/%s", r.GetFullName(), hook)
 
@@ -544,7 +542,7 @@ func DeleteHook(c *gin.Context) {
 	o := org.Retrieve(c)
 	r := repo.Retrieve(c)
 	u := user.Retrieve(c)
-	hook := c.Param("hook")
+	hook := html.EscapeString(c.Param("hook"))
 
 	entry := fmt.Sprintf("%s/%s", r.GetFullName(), hook)
 
@@ -641,7 +639,7 @@ func RedeliverHook(c *gin.Context) {
 	o := org.Retrieve(c)
 	r := repo.Retrieve(c)
 	u := user.Retrieve(c)
-	hook := c.Param("hook")
+	hook := html.EscapeString(c.Param("hook"))
 
 	entry := fmt.Sprintf("%s/%s", r.GetFullName(), hook)
 

api/repo.go

@@ -462,16 +462,16 @@ func GetRepos(c *gin.Context) {
 // of repos for an org from the configured backend.
 func GetOrgRepos(c *gin.Context) {
 	// capture middleware values
+	o := org.Retrieve(c)
 	u := user.Retrieve(c)
-	org := c.Param("org")
 
 	// update engine logger with API metadata
 	//
 	// https://pkg.go.dev/github.com/sirupsen/logrus?tab=doc#Entry.WithFields
 	logrus.WithFields(logrus.Fields{
-		"org":  org,
+		"org":  o,
 		"user": u.GetName(),
-	}).Infof("reading repos for org %s", org)
+	}).Infof("reading repos for org %s", o)
 
 	// capture page query parameter if present
 	page, err := strconv.Atoi(c.DefaultQuery("page", "1"))

api/secret.go

@@ -6,20 +6,19 @@ package api
 
 import (
 	"fmt"
+	"html"
 	"net/http"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/gin-gonic/gin"
 	"github.com/go-vela/server/router/middleware/user"
 	"github.com/go-vela/server/scm"
 	"github.com/go-vela/server/secret"
 	"github.com/go-vela/server/util"
-
 	"github.com/go-vela/types/constants"
 	"github.com/go-vela/types/library"
-
-	"github.com/gin-gonic/gin"
 	"github.com/sirupsen/logrus"
 )
 
@@ -83,10 +82,10 @@ import (
 func CreateSecret(c *gin.Context) {
 	// capture middleware values
 	u := user.Retrieve(c)
-	e := c.Param("engine")
-	t := c.Param("type")
-	o := c.Param("org")
-	n := c.Param("name")
+	e := html.EscapeString(c.Param("engine"))
+	t := html.EscapeString(c.Param("type"))
+	o := html.EscapeString(c.Param("org"))
+	n := html.EscapeString(c.Param("name"))
 
 	entry := fmt.Sprintf("%s/%s/%s", t, o, n)
 
@@ -260,10 +259,10 @@ func CreateSecret(c *gin.Context) {
 func GetSecrets(c *gin.Context) {
 	// capture middleware values
 	u := user.Retrieve(c)
-	e := c.Param("engine")
-	t := c.Param("type")
-	o := c.Param("org")
-	n := c.Param("name")
+	e := html.EscapeString(c.Param("engine"))
+	t := html.EscapeString(c.Param("type"))
+	o := html.EscapeString(c.Param("org"))
+	n := html.EscapeString(c.Param("name"))
 
 	var teams []string
 	// get list of user's teams if type is shared secret and team is '*'
@@ -428,11 +427,11 @@ func GetSecrets(c *gin.Context) {
 func GetSecret(c *gin.Context) {
 	// capture middleware values
 	u := user.Retrieve(c)
-	e := c.Param("engine")
-	t := c.Param("type")
-	o := c.Param("org")
-	n := c.Param("name")
-	s := strings.TrimPrefix(c.Param("secret"), "/")
+	e := html.EscapeString(c.Param("engine"))
+	t := html.EscapeString(c.Param("type"))
+	o := html.EscapeString(c.Param("org"))
+	n := html.EscapeString(c.Param("name"))
+	s := strings.TrimPrefix(html.EscapeString(c.Param("secret")), "/")
 
 	entry := fmt.Sprintf("%s/%s/%s/%s", t, o, n, s)
 
@@ -548,11 +547,11 @@ func GetSecret(c *gin.Context) {
 func UpdateSecret(c *gin.Context) {
 	// capture middleware values
 	u := user.Retrieve(c)
-	e := c.Param("engine")
-	t := c.Param("type")
-	o := c.Param("org")
-	n := c.Param("name")
-	s := strings.TrimPrefix(c.Param("secret"), "/")
+	e := html.EscapeString(c.Param("engine"))
+	t := html.EscapeString(c.Param("type"))
+	o := html.EscapeString(c.Param("org"))
+	n := html.EscapeString(c.Param("name"))
+	s := strings.TrimPrefix(html.EscapeString(c.Param("secret")), "/")
 
 	entry := fmt.Sprintf("%s/%s/%s/%s", t, o, n, s)
 
@@ -695,11 +694,11 @@ func UpdateSecret(c *gin.Context) {
 func DeleteSecret(c *gin.Context) {
 	// capture middleware values
 	u := user.Retrieve(c)
-	e := c.Param("engine")
-	t := c.Param("type")
-	o := c.Param("org")
-	n := c.Param("name")
-	s := strings.TrimPrefix(c.Param("secret"), "/")
+	e := html.EscapeString(c.Param("engine"))
+	t := html.EscapeString(c.Param("type"))
+	o := html.EscapeString(c.Param("org"))
+	n := html.EscapeString(c.Param("name"))
+	s := strings.TrimPrefix(html.EscapeString(c.Param("secret")), "/")
 
 	entry := fmt.Sprintf("%s/%s/%s/%s", t, o, n, s)
 

api/user.go

@@ -7,18 +7,17 @@ package api
 import (
 	"encoding/base64"
 	"fmt"
+	"html"
 	"net/http"
 	"strconv"
 
+	"github.com/gin-gonic/gin"
 	"github.com/go-vela/server/database"
 	"github.com/go-vela/server/router/middleware/token"
 	"github.com/go-vela/server/router/middleware/user"
 	"github.com/go-vela/server/scm"
 	"github.com/go-vela/server/util"
-
 	"github.com/go-vela/types/library"
-
-	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 	"github.com/sirupsen/logrus"
 )
@@ -355,7 +354,7 @@ func UpdateCurrentUser(c *gin.Context) {
 func GetUser(c *gin.Context) {
 	// capture middleware values
 	u := user.Retrieve(c)
-	user := c.Param("user")
+	user := html.EscapeString(c.Param("user"))
 
 	// update engine logger with API metadata
 	//
@@ -528,7 +527,7 @@ func GetUserSourceRepos(c *gin.Context) {
 func UpdateUser(c *gin.Context) {
 	// capture middleware values
 	u := user.Retrieve(c)
-	user := c.Param("user")
+	user := html.EscapeString(c.Param("user"))
 
 	// update engine logger with API metadata
 	//
@@ -625,7 +624,7 @@ func UpdateUser(c *gin.Context) {
 func DeleteUser(c *gin.Context) {
 	// capture middleware values
 	u := user.Retrieve(c)
-	user := c.Param("user")
+	user := html.EscapeString(c.Param("user"))
 
 	// update engine logger with API metadata
 	//