gabriel / muse public
patch fix/issue-label-url-encode #1 / 1
gabriel · 67 days ago · Apr 10, 2026 · Diff

security: URL-encode label name in muse hub issue label --remove path segment

Label names may contain spaces or special characters (e.g. 'good first issue'). Without encoding, those characters corrupt the DELETE URL path, potentially enabling path traversal. Use urllib.parse.quote(label_name, safe='') to safely encode before inserting into the URL.

sha256:c009852a5de1aa0c037a8f349e231b06d5ce268701bb5022bee8ecfe2869801e sha
sha256:49d11ed17deec1d97867d332ea0205a9df55d97234de8f3f7a52ee81fc15ee5a parent
sha256:5670475136b5c9b898f27840be7f27ae502de3deca10ff350a9b011eec86c3d9 snapshot
← Older Oldest on fix/issue-label-url-encode
All commits
Newer → Latest on fix/issue-label-url-encode

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:c009852a5de1aa0c037a8f349e231b06d5ce268701bb5022bee8ecfe2869801e --body "your comment"