[PR #781] [CLOSED] Attachment ID sanitization #783

New issue

Closed

opened 2026-02-26 22:32:32 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 22:32:32 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/rudrankriyam/App-Store-Connect-CLI/pull/781
Author: @cursor[bot]
Created: 2/25/2026
Status: ❌ Closed

Base: feat/web-review-resolution ← Head: cursor/attachment-id-sanitization-bf05

📝 Commits (1)

db7e95d Sanitize attachment ID fallback filename

📊 Changes

2 files changed (+20 additions, -0 deletions)

View changed files

📝 internal/cli/web/web_review.go (+8 -0)
📝 internal/cli/web/web_review_test.go (+12 -0)

📄 Description

Summary

Fixed a path traversal vulnerability in normalizeAttachmentFilename by applying filepath.Base() to AttachmentID when it's used as a fallback filename, preventing malicious AttachmentID values from escaping the intended download directory.

Validation

make format
make lint
make test

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/rudrankriyam/App-Store-Connect-CLI/pull/781 **Author:** [@cursor[bot]](https://github.com/apps/cursor) **Created:** 2/25/2026 **Status:** ❌ Closed **Base:** `feat/web-review-resolution` ← **Head:** `cursor/attachment-id-sanitization-bf05` --- ### 📝 Commits (1) - [`db7e95d`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/db7e95d2f81807ad6224b61c09c073ed53a849ba) Sanitize attachment ID fallback filename ### 📊 Changes **2 files changed** (+20 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `internal/cli/web/web_review.go` (+8 -0) 📝 `internal/cli/web/web_review_test.go` (+12 -0) </details> ### 📄 Description ## Summary - Fixed a path traversal vulnerability in `normalizeAttachmentFilename` by applying `filepath.Base()` to `AttachmentID` when it's used as a fallback filename, preventing malicious `AttachmentID` values from escaping the intended download directory. ## Validation - [x] `make format` - [x] `make lint` - [x] `make test` --- --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>