fix(autoupdate): Ensure GitHub API requests use token #6535
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughAdded GitHub API token authentication to the autoupdate mechanism. When extracting JSON hashes from GitHub's API, the code now conditionally attaches an Authorization header with the token and sets the appropriate API version header for authenticated requests. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
CHANGELOG.md(1 hunks)lib/autoupdate.ps1(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-08-31T01:48:00.222Z
Learnt from: z-Fng
Repo: ScoopInstaller/Scoop PR: 6471
File: CHANGELOG.md:9-9
Timestamp: 2025-08-31T01:48:00.222Z
Learning: The Scoop project's CHANGELOG.md follows a convention of tracking PR numbers only, not issue numbers, according to the maintainer z-Fng.
Applied to files:
CHANGELOG.md
🔇 Additional comments (1)
CHANGELOG.md (1)
14-14: LGTM! Changelog entry is correct.The entry properly documents the bug fix with the correct PR reference and follows the project's convention of tracking PR numbers only.
lib/autoupdate.ps1
Outdated
|
|
||
| if (($url -like '*api.github.com/*') -and (Get-GitHubToken)) { | ||
| $wc.Headers.Add('Authorization', "Bearer $(Get-GitHubToken)") | ||
| $wc.Headers.Add('X-GitHub-Api-Version', "2022-11-28") | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
Good fix, but strengthen the URL pattern matching for security.
The authentication logic correctly addresses the missing API token issue. However, the wildcard pattern *api.github.com/* could match unintended domains like badapi.github.com or api.github.com.evil.com, potentially leaking the token.
Apply this diff to use a more secure pattern:
- if (($url -like '*api.github.com/*') -and (Get-GitHubToken)) {
+ if (($url -match '^https?://api\.github\.com/') -and (Get-GitHubToken)) {
$wc.Headers.Add('Authorization', "Bearer $(Get-GitHubToken)")
$wc.Headers.Add('X-GitHub-Api-Version', "2022-11-28")
}Please verify that Get-GitHubToken is available in the codebase:
🏁 Script executed:
#!/bin/bash
# Search for the Get-GitHubToken function definition
rg -n "function Get-GitHubToken" --type ps1
# Also check for any aliases or alternate definitions
rg -n "Get-GitHubToken" --type ps1 -C 2Length of output: 55
🏁 Script executed:
#!/bin/bash
# Search for Get-GitHubToken in all PowerShell files without type constraint
fd -e ps1 -x rg -l "Get-GitHubToken" {}
# Get context around the function definition
fd -e ps1 -x rg -n "Get-GitHubToken|function Get-GitHubToken" -C 3 {}Length of output: 1890
Strengthen the URL pattern matching for security—Get-GitHubToken is properly defined.
The authentication logic is sound, and Get-GitHubToken exists at line 580. However, the wildcard pattern *api.github.com/* is overly broad and could match unintended domains like badapi.github.com or api.github.com.evil.com. This is inconsistent with the more restrictive regex patterns used elsewhere in lib/download.ps1 (e.g., line 97: api\.github\.com/repos).
Apply this diff:
- if (($url -like '*api.github.com/*') -and (Get-GitHubToken)) {
+ if (($url -match '^https?://api\.github\.com/') -and (Get-GitHubToken)) {
$wc.Headers.Add('Authorization', "Bearer $(Get-GitHubToken)")
$wc.Headers.Add('X-GitHub-Api-Version', "2022-11-28")
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if (($url -like '*api.github.com/*') -and (Get-GitHubToken)) { | |
| $wc.Headers.Add('Authorization', "Bearer $(Get-GitHubToken)") | |
| $wc.Headers.Add('X-GitHub-Api-Version', "2022-11-28") | |
| } | |
| if (($url -match '^https?://api\.github\.com/') -and (Get-GitHubToken)) { | |
| $wc.Headers.Add('Authorization', "Bearer $(Get-GitHubToken)") | |
| $wc.Headers.Add('X-GitHub-Api-Version', "2022-11-28") | |
| } |
🤖 Prompt for AI Agents
In lib/autoupdate.ps1 around lines 121 to 125, the URL wildcard
'*api.github.com/*' is too permissive and can match malicious hosts (e.g.
badapi.github.com); replace the simple wildcard test with a robust host check:
parse the URL into a [uri] and verify $uri.Host -eq 'api.github.com' (or
optionally match a strict regex like '^api\.github\.com$'), then only add the
Authorization and X-GitHub-Api-Version headers when that host check passes and
Get-GitHubToken returns a token.
z-Fng
changed the title
z-Fng
force-pushed
the
fix-github-mode
branch
from
4531320 to
9bd1f98
Compare
z-Fng
force-pushed
the
fix-github-mode
branch
from
9bd1f98 to
ee4aef9
Compare
1 participant
Motivation and Context
When retrieve hash from GitHub API, the token was not included in the request header.
Changes
Related Issues/PRs:
How Has This Been Tested?
Checklist:
developbranch.Summary by CodeRabbit