iterative-works/iw-cli
Watch
3
0
Fork
You've already forked iw-cli
 0
Code Issues 119 Pull requests 1 Projects Releases 34 Packages Wiki Activity Actions

GitLabClient.encodedRepo escapes only /, so a repo slug with ? # & or % corrupts every glab api path #558

New issue
Closed
opened 2026-09-14 10:13:14 +00:00 by mph · 1 comment
mph commented 2026-09-14 10:13:14 +00:00
Owner
Copy link

Found while working IW-517.

GitLabClient.encodedRepo (core/adapters/GitLabClient.scala:618) escapes only /. A repository slug carrying ?, #, & or % can therefore corrupt any glab api path built from it.

Pre-existing, and shared by every command builder in the file — not introduced by IW-517.

encodedQueryValue (core/adapters/GitLabClient.scala:851) is the correct pattern. Fix once, centrally, so every builder in the file gets it.

Found while working IW-517. `GitLabClient.encodedRepo` (`core/adapters/GitLabClient.scala:618`) escapes only `/`. A repository slug carrying `?`, `#`, `&` or `%` can therefore corrupt any `glab api` path built from it. Pre-existing, and shared by every command builder in the file — not introduced by IW-517. `encodedQueryValue` (`core/adapters/GitLabClient.scala:851`) is the correct pattern. Fix once, centrally, so every builder in the file gets it.
claude commented 2026-09-14 18:59:58 +00:00
Member
Copy link

Intake: agent-ready
Workflow: diagnostic
Reason: all gates passed
Analysis: project-management/issues/IW-558/analysis.md on branch IW-558

Intake: agent-ready Workflow: diagnostic Reason: all gates passed Analysis: project-management/issues/IW-558/analysis.md on branch IW-558
mph closed this issue 2026-09-15 09:33:16 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
IW-75
IW-80
IW-111
IW-122
IW-152
IW-189
IW-197
IW-227
IW-339
IW-350
IW-353
IW-398
IW-425
IW-429
IW-430
IW-438
IW-440
IW-441
IW-442
IW-443
IW-452
IW-455
IW-456
IW-468
IW-469
IW-477
IW-492
IW-494
IW-543
IW-565
IW-568
IW-569
IW-570
IW-572
IW-577
IW-579
IW-584
IW-585
IW-586
IW-598
IW-783
IW-773
IW-770
IW-642
IW-643
IW-644
IW-649
IW-654
IW-661
IW-662
IW-666
IW-667
IW-754
IW-741
IW-740
IW-733
IW-724
IW-719
IW-755
IW-700
IW-756
IW-759
IW-795
IW-699
IW-552
IW-796
IW-797
IW-750
IW-671
IW-681
IW-762
IW-790
IW-557
IW-548
IW-706
IW-513
IW-551
IW-707
IW-712
IW-708
IW-701
IW-690
IW-687
IW-682
IW-679
IW-749
IW-672
IW-744
IW-745
IW-678
IW-670
IW-734
IW-730
IW-610
IW-612
IW-607
IW-718
IW-718-phase-01
IW-715
IW-710
IW-702
IW-608
IW-675
IW-676
IW-677
IW-691
IW-599
IW-652
IW-651
IW-650
IW-656
IW-636
IW-631
IW-613
IW-637
IW-628
IW-629
IW-622
IW-623
IW-620
IW-616
IW-606
IW-601
IW-581
IW-491
IW-583
IW-578
IW-555
dashboard-control-plane
IW-556
IW-566
IW-544
IW-558
IW-517
chore/bump-version-0.15.0
chore/bump-version-0.14.0
IW-463
merge-url-after-a-separator
IW-497
IW-512
IW-526
dashboard-layer-dependencies
chore/bump-version-0.13.0
docs/skills-0.13.0
chore/bump-version-0.12.0
docs/api-0.12.0
phase-gate-followups
chore/bump-version-0.11.0
chore/regenerate-skills-0.11.0
batch-implement-blockers
IW-476
IW-436
IW-437
IW-422
IW-399
docs/forgejo-fj-cli-guidance
fix/forgejo-commit-status-field
wip/dashboard-control-plane-effort
feat/sbt-server-cleanup
IW-389
IW-382
IW-382-phase-02
IW-382-phase-01
wip/decide-outcome-ci-statuses
IW-347
chore/bump-version-0.6.1
IW-347-phase-02
fix-ssh-url-parsing
IW-347-phase-01
IW-346
IW-346-phase-02
IW-346-phase-01
IW-345
IW-345-phase-04
IW-345-phase-03
IW-345-phase-02
IW-345-phase-01
IW-344
IW-344-phase-03
IW-344-phase-02
IW-344-phase-01
fix-bloop-daemon-leak
fix-start-team-identifier
IW-340
IW-340-phase-01
fix-release-script-after-IW-106
add-build-iw-cli-skills
session-setup-hooks
IW-331
IW-106
IW-323
IW-323-phase-04
IW-323-phase-02
IW-323-phase-01
release/0.3.7
fix/claude-sync-and-batch-flag
fix/batch-implement-resume
chore/bump-0.3.6
fix/gitlab-work-items-url
fix/glab-mr-list-state-flag
chore/bump-version-0.3.5
IW-309
IW-305
IW-305-phase-01
IW-292
IW-292-phase-03
IW-292-phase-01
IW-289
fix/glab-mr-create-flags
IW-289-phase-07
IW-289-phase-06
IW-289-phase-05
IW-289-phase-02
IW-289-phase-01
IW-275
IW-275-phase-03
IW-275-phase-02
IW-275-phase-01
fix/glab-phase-advance
IW-274
IW-274-phase-05
IW-274-phase-03
IW-274-phase-02
IW-274-phase-01
IW-188
IW-188-phase-06
IW-188-phase-05
IW-272
IW-202
IW-188-phase-04
IW-188-phase-03
IW-202-phase-04
IW-202-phase-03
IW-202-phase-02
IW-202-phase-01
chore/bump-version-0.3.4
fix/phase-commit-uncommitted-files
release-automation
feat/update-command
chore/bump-version-0.3.0
wip/status-server-query
fix/register-team-and-error-handling
IW-148
docs-update-iw222
IW-222
IW-222-phase-04
IW-222-phase-03
IW-222-phase-01
IW-205
IW-205-phase-03
IW-205-phase-02
fix/ci-test-timeout
IW-206
IW-206-phase-07
IW-206-phase-06
IW-206-phase-05
IW-206-phase-04
IW-206-phase-03
IW-203
fix/ci-and-scalafix
IW-196
IW-175
IW-100
IW-100-phase-01
IW-164
IW-126
IW-126-phase-01
IW-103
IW-82
IW-82-phase-05
IW-82-phase-01
IW-92
IW-79
fix/github-issue-id-prefix
IW-88
IW-92-phase-01
IW-88-phase-01
IW-90
IW-74
IW-107
IW-79-phase-05
IW-79-phase-01
IW-72
IW-63
IW-46
46
46-phase-06
46-phase-05
48
IWLE-132
IWLE-131
IWLE-131-phase-03
IWLE-131-phase-02
IWLE-100
IWLE-76-phase-02
v0.22.1
vlatest
v0.22.0
v0.21.0
v0.20.0
v0.19.0
v0.18.0
v0.17.2
v0.17.1
v0.17.0
v0.16.0
v0.15.0
v0.14.0
v0.13.0
v0.12.0
v0.11.0
IW-463/batch-attempt/phase-02
IW-463/batch-attempt/phase-01
IW-463/batch-attempt/integration
IW-463/pre-implementation
v0.9.0
v0.8.0
v0.7.0
v0.6.2
v0.6.1
v0.6.0
v0.5.0
v0.4.0
v0.3.7
v0.3.6
v0.3.5
v0.3.4
v0.3.3
v0.3.2
v0.3.1
v0.3.0
v0.2.0
v0.1.0
Labels
Clear labels   
agent-ready

   
bug
Something isn't working

  
contract
Run the tool-contract suite on this PR

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
needs-human

   
needs-input
Intake asked the human a question on the issue; waiting for the answer

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
agent-ready
bug
contract
documentation
duplicate
enhancement
good first issue
help wanted
invalid
needs-human
needs-input
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
iterative-works/iw-cli#558
No description provided.