react-doctor/git-provider-url-injection-risk

Interpolating request input into a Git provider URL without encoding lets an attacker inject extra path segments or parameters and redirect the request.

• Category: Security
• Severity: warn
• Source: oxlint-plugin-react-doctor
• Framework: global
• Enabled when: production source files (.js/.ts/.jsx/.tsx, etc.); test/build/doc/generated paths skipped
• Tags: security-scan
• Default: Enabled

Validation prompt

Use this to decide whether a fired diagnostic is real or a false positive.

Fires when a literal Git-provider host (api.github.com, github.com, gitlab.com, or bitbucket.org) appears and, within the next ~200 chars up to the template's closing backtick, a ${…} interpolation reads request-shaped input — a member access on params/searchParams/query/req/request/input/payload, or the markers untrusted/decodeURI… — that is NOT wrapped in encodeURIComponent(. Only the first matching host is reported. FALSE POSITIVE: the interpolated value is an internal constant or config (a commit SHA, version string, or a bare owner/repo/slug/branch identifier) rather than external input — those are deliberately not matched — or the segment is already encodeURIComponent(...)-wrapped, which suppresses the finding.

Fix prompt

Use this once validation confirms the diagnostic is real.

Validate each path component (owner, repo, org, branch) against a strict slug allowlist (letters, digits, -, _, .) and reject anything else before building the URL. Encode every interpolated segment with encodeURIComponent, or build the URL with the URL/URLSearchParams API (or the provider SDK) instead of raw template strings, so input cannot add path segments, .., or query parameters.

Related rules

More Security rules from the rules reference:

• react-doctor/iframe-missing-sandbox: Add sandbox="" (or a curated, minimal set of allow- tokens) to your iframe to restrict embedded content.
• react-doctor/import-metadata-execution-risk: Evaluating imported metadata or file contents (EXIF, manifests, presets, uploads, archives) as code lets an attacker achieve remote code execution.
• react-doctor/insecure-crypto-risk: Weak primitives (MD5, SHA-1, DES, RC4), non-timing-safe comparisons, or `Math.random()` for security values make signatures, tokens, and passwords easier to forge or guess.
• react-doctor/insecure-session-cookie: Auth cookie missing HttpOnly protection
• react-doctor/jsx-no-script-url: Disallow javascript: URLs in href — they execute arbitrary code, and React 19 throws on them.