semaphoreci / cli

Semaphore 2.0 Command Line Interface
Apache License 2.0
25 stars 13 forks source link

URL injection/encoding bug in notifications #179

Open mkarnebeek opened 3 years ago

mkarnebeek commented 3 years ago
~/Desktop $ sem get notifications
NAME                                         AGE
test/name                                    89d
test-name                                    375d
~/Desktop $ sem get notification "test-name"
apiVersion: v1alpha
kind: Notification
...

So far so good. Until...

~/Desktop $ sem get notification "test/name"
error: http status 404 with message "Not Found
" received from upstream

Ok, so maybe it needs some escaping/encoding?

~/Desktop $ sem get notification "test//name"
error: http status 404 with message "Not Found
" received from upstream

~/Desktop $ sem get notification "test%2Fname"
error: http status 404 with message "Not Found
" received from upstream

Nope. Seems broken. Maybe try something crazy?

~/Desktop $ sem get notification "test\name"
error: http status 404 with message "{"error":"Notification test\\name not found","code":5,"message":"Notification test\\name not found"}" received from upstream

Wow, this last one seems like this was the error message intended to be received, were the previous errors seem to be calling a different actually non-existing endpoint because it, presumably, just put the user-provided string in the url.