Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Shell-quote the URL in Studio's curl snippet

Open Beginner friendly
  • Is something wrong?
#607 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
bash, typescript
Domain
frontend, security

Research direction

The unquoted URL is built in apps/studio/src/lib/equivalents.ts around line 33, in the curl -s -X POST template. Look at how the existing shellQuote helper is used elsewhere in that file and wrap origin plus path with it. Done means a unit test with hostile names (single quote, $(), backticks, newline) produces a snippet that passes bash -n.

Written by the indexing model from the issue text.

Description

area:studio type:security

Scope disposition, 2026-10-18T19:48Z

Phase: P8 Post-v0.1. Valid unresolved improvement, explicitly deferred by the owner's critical-only v0.1 direction. Not a blocker of #102 or the bounded v0.1 milestone. Original reproduction, acceptance criteria and test plan below remain future work; no fix or successful verification is claimed. Do not begin until v0.1 is complete and future intake selects this task.

Parent epic: #546

Severity: Low. Studio's "copy as curl" snippet for table queries interpolates the URL path unquoted. A table that comes from a source file whose name contains ' (for example docs/q'x.csv) produces a command that breaks shell parsing when pasted, and flips the quoting of the following lines. No code execution was achieved: the request body contains only sanitised SQL names, and a '$(touch PWNED)' payload did not execute. But the snippet is user-facing shell built from untrusted names.
Status: CONFIRMED (broken command). Injection: not reproduced.

Where and how

apps/studio/src/lib/equivalents.ts:33: `curl -s -X POST ${origin}${path}` does not pass the URL through the existing shellQuote helper. encodeURIComponent leaves '()*!~ unescaped.

Context

CWE-78 (defence in depth). Copy-paste commands are a common injection channel.

Verification

  • Playwright captured the snippet for docs/q'x.csv: .../tables/proj%3Adocs%2Fq'x.csv%23table/query \.
  • Pasting it into bash gave unexpected EOF while looking for matching '.

Possible solutions

  1. Recommended: shellQuote(origin + path), plus a unit test with hostile names (', $(), backticks, newline).
  2. Percent-encode ' in the path. Narrower.

Acceptance criteria

  • Every generated snippet survives bash -n for a fixture set of hostile file names.
Dominant language
TypeScript
Stars
2
Forks
1
Avg merge
5h 36m
Merged PRs (30d)
221

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from burakdede/lorepack

All issues in burakdede/lorepack

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.