Skip to content

fix: prevent path traversal by sanitizing URLs - #1011

Merged
barjin merged 7 commits into
v3from
fix/prevent-path-traversal
Aug 27, 2026
Merged

fix: prevent path traversal by sanitizing URLs#1011
barjin merged 7 commits into
v3from
fix/prevent-path-traversal

Conversation

@barjin

@barjin barjin commented Aug 26, 2026

Copy link
Copy Markdown
Member

Swaps string interpolation in URL building for sanitized composition.

Related to apify/apify-client-python#1025
Closes #1005

@github-actions github-actions Bot added this to the 148th sprint - Tooling team milestone Aug 26, 2026
@github-actions github-actions Bot added t-tooling Issues with this label are in the ownership of the tooling team. tested Temporary label used only programatically for some analytics. labels Aug 26, 2026
@github-actions

github-actions Bot commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

✅ The link checker did not find any broken links.

See more at https://github.com/apify/apify-client-js/actions/runs/32943298846#summary-98098621858

@barjin
barjin marked this pull request as ready for review August 26, 2026 07:35
@barjin
barjin requested a review from szaganek as a code owner August 26, 2026 07:35
@barjin
barjin requested review from janbuchar and vdusek and removed request for szaganek August 26, 2026 07:37

@vdusek vdusek left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As we discussed on team sync, maybe this should target v3? cc @B4nan

@B4nan

B4nan commented Aug 26, 2026

Copy link
Copy Markdown
Member

Yeah, let's retarget. If this only popped during internal audits and nobody is waiting for the fix, it's better to stay safe.

@janbuchar janbuchar left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me code-wise.

@vdusek vdusek left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Requesting changes for retarget to v3

@barjin
barjin changed the base branch from master to v3 August 27, 2026 08:52
@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

⚠️ There are broken links in the documentation.

See more at https://github.com/apify/apify-client-js/actions/runs/33059036205#summary-98472930707

@vdusek vdusek left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

}

// @public
export class ArgumentValidationError extends Error {

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These changes are from the previous commits to v3, the checks were just failing without them.

@barjin
barjin merged commit 7a73908 into v3 Aug 27, 2026
8 checks passed
@barjin
barjin deleted the fix/prevent-path-traversal branch August 27, 2026 09:34
vdusek pushed a commit that referenced this pull request Sep 8, 2026
Swaps string interpolation in URL building for sanitized composition. 

Related to apify/apify-client-python#1025
Closes #1005
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

t-tooling Issues with this label are in the ownership of the tooling team. tested Temporary label used only programatically for some analytics.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

URL-encode record keys and request IDs to prevent path traversal

5 participants