Skip to content

Fix insecure regex in URL validation and normalize repository data#2529

Closed
Uday111-ai wants to merge 1 commit intoDeepSourceCorp:masterfrom
Uday111-ai:fix/regex-url-validation
Closed

Fix insecure regex in URL validation and normalize repository data#2529
Uday111-ai wants to merge 1 commit intoDeepSourceCorp:masterfrom
Uday111-ai:fix/regex-url-validation

Conversation

@Uday111-ai
Copy link
Copy Markdown

This PR addresses two issues:

Security/Bug Fix: The regex used to parse GitHub URLs in
gfi/populate.py
was flawed. It used a character class [...] instead of a group
(...)
for the protocol, and lacked a start/end anchor. This allowed invalid URLs (e.g., notgithub.com) to pass validation.

Fix: Updated GH_URL_PATTERN to r"^(?:https?://)?github.com/(?P[\w.-]+)/(?P[\w.-]+)/?$"
Data Consistency: The
data/repositories.toml
file had an inconsistent entry with a protocol prefix.

Fix: Removed https:// from the entry for pyupio/safety to match the project convention.

Verification:

Validated the new regex against various test cases (valid and invalid URLs).
Verified that
gfi/test_data.py
passes with the changes.

@vercel
Copy link
Copy Markdown

vercel Bot commented Dec 19, 2025

@Uday111-ai is attempting to deploy a commit to the DeepSource Team on Vercel.

A member of the Team first needs to authorize it.

@jai-deepsource
Copy link
Copy Markdown
Contributor

Thank you for your submission. We're closing all existing PRs and transitioning to a Google Form. Please use the form for future submissions: https://docs.google.com/forms/d/e/1FAIpQLSfHSt8UHvACokWv8uwiImidTIhuSCAUXnvSGs-TULshdLl9Qw/viewform

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants