fix: 11 - add validation of Zenodo API URL and deposition_id (#780)

* feat: add validation of Zenodo API URL and deposition_id

* improve wording

* doc: add release note

* fix: remove redundant validation of API_URL

* Update doc/release_notes.md

Co-authored-by: Thomas Gilon <thomas.gilon@openenergytransition.org>

* doc: fix formatting of release note

---------

Co-authored-by: Thomas Gilon <thomas.gilon@openenergytransition.org>

Author: daniel-rdt

doc/release_notes.md

@@ -37,17 +37,19 @@
 
 * Update benchmarking documentation tables and figures for v0.7.1 ([#711](https://github.com/open-energy-transition/open-tyndp/pull/711)).
 
-* Migrate the Sphinx/RST-based documentation to MkDocs/Markdown, as a follow-up to the [upstream migration](https://github.com/PyPSA/pypsa-eur/pull/2162) ([754](https://github.com/open-energy-transition/open-tyndp/pull/754)).
+* Migrate the Sphinx/RST-based documentation to MkDocs/Markdown, as a follow-up to the [upstream migration](https://github.com/PyPSA/pypsa-eur/pull/2162) ([#754](https://github.com/open-energy-transition/open-tyndp/pull/754)).
 
 **Developers Note**
 
 * Change GitHub issue templates to comply with ISO security checks ([#714](https://github.com/open-energy-transition/open-tyndp/pull/714), [#730](https://github.com/open-energy-transition/open-tyndp/pull/730)).
 
-* Introduce SBOM/Grype vulnerability scanning workflow, as a follow-up to the [upstream addition](https://github.com/PyPSA/pypsa-eur/pull/2164) ([754](https://github.com/open-energy-transition/open-tyndp/pull/754)).
+* Introduce SBOM/Grype vulnerability scanning workflow, as a follow-up to the [upstream addition](https://github.com/PyPSA/pypsa-eur/pull/2164) ([#754](https://github.com/open-energy-transition/open-tyndp/pull/754)).
 
-* Ensure `inflow_t` is always defined in `attach_hydro`, resolving a pylint use-before-assignment issue ([777](https://github.com/open-energy-transition/open-tyndp/pull/777)).
+* Ensure `inflow_t` is always defined in `attach_hydro`, resolving a pylint use-before-assignment issue ([#777](https://github.com/open-energy-transition/open-tyndp/pull/777)).
 
-* Add missing regex anchors with `re.fullmatch` to `create_zenodo_deposition_cli` utils script ([778](https://github.com/open-energy-transition/open-tyndp/pull/778)).
+* Add missing regex anchors with `re.fullmatch` to `create_zenodo_deposition_cli` utils script ([#778](https://github.com/open-energy-transition/open-tyndp/pull/778)).
+
+* Add validation of Zenodo deposition ID in `create_zenodo_deposition_cli` to close URL-manipulation finding ([#780](https://github.com/open-energy-transition/open-tyndp/pull/780)).
 
 
 ## Upcoming PyPSA-Eur Release

utils/create_zenodo_deposition_cli.py

@@ -310,6 +310,13 @@ def publish_zenodo_deposition(deposition_id: int) -> requests.Response:
     Response
         The response from the Zenodo API after publishing the deposition.
     """
+    # Validate id to be positive integer (rejecting bool, int-like strings and traversals)
+    if (
+        isinstance(deposition_id, bool)
+        or not isinstance(deposition_id, int)
+        or deposition_id <= 0
+    ):
+        raise ValueError(f"Invalid Zenodo deposition ID: {deposition_id!r}")
     r = requests.post(
         f"{ZENODO_API_URL}/deposit/depositions/{deposition_id}/actions/publish",
         params={"access_token": ZENODO_API_KEY},