Encode caller-supplied path parameters in legacy modules - #1662
Closed
devin-ai-integration[bot] wants to merge 2 commits into
Closed
Conversation
The hand-written legacy modules interpolate caller-supplied identifiers (user IDs, invitation tokens, MFA factor IDs, organization IDs, external IDs, role/permission slugs) directly into URL path templates without encoding. HttpClient.getResourceURL then resolves the result with the WHATWG URL parser, which honors ../ dot-segments and ?/# metacharacters. An integrator that forwards an attacker-influenced identifier into one of these methods could have its API-key-authenticated request retargeted to an arbitrary same-verb WorkOS endpoint. Wrap each interpolated path parameter in a shared encodePathParameter helper, matching the encodeURIComponent pattern already used by the auto-generated modules. The helper preserves ':' so existing RBAC slugs (e.g. users:read) keep their wire format.
Contributor
Author
Original prompt from Linear User
|
Contributor
Author
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
devin-ai-integration
Bot
changed the title
Contributor
Greptile SummaryThis PR prevents caller-supplied identifiers from changing legacy SDK request paths. The main changes are:
Confidence Score: 5/5This looks safe to merge.
Important Files Changed
Reviews (2): Last reviewed commit: "Reject dot-only path segments in encodeP..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
encodeURIComponent leaves '.' and '..' unchanged, and the WHATWG URL
parser removes them as relative path segments. For a non-terminal
template such as /feature-flags/${slug}/enable a slug of '..' still
climbs and retargets the request (e.g. to /enable). Percent-encoding the
dots does not help because the parser also treats the %2e forms as dot
segments. Fail closed: throw for '.' and '..', which are never valid
WorkOS identifiers.
gjtorikian
approved these changes
Jul 27, 2026
devin-ai-integration
Bot
deleted the
feature/sec-1216-path-parameter-injection-in-workos-node-legacy-modules-user
branch
July 27, 2026 16:15
devin-ai-integration
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The hand-written legacy SDK modules (User Management, MFA, SSO, Organizations, Organization Domains) interpolated caller-supplied identifiers directly into request paths. This change URL-encodes those path parameters, consistent with the generated modules.
Please review before merging.