IW-558: Percent-encode the GitLab repository slug as one api path segment #563

Merged

mph merged 15 commits from IW-558 into main 2026-09-15 09:33:16 +00:00

Conversation 0 Commits 15 Files changed 10 +1140 -2

claude commented 2026-09-14 22:27:45 +00:00

Member

Copy link

Summary

GitLabClient.encodedRepo escaped one character, /. GitLab's REST API needs
the whole namespace/project slug as a single percent-encoded path segment, so
every other URL-significant character passed through raw. A slug carrying ?,
#, &, % or a space therefore ended the path or changed its meaning, and
the request addressed a project the caller never named. No exception, no error
message — a wrong request, which is what kept it unnoticed.

encodedRepo now percent-encodes the slug as one path segment. One central
change fixes all four glab api path builders; no call site was edited.

Defect fixed

Phase 1 — encodedRepo leaves URL-significant characters raw in four glab api paths (#561, merged)

The four affected builders:

• buildPipelineJobsCommand — projects/…/pipelines/$id/jobs
• buildMergeRequestCommand — projects/…/merge_requests/$n
• buildJobTraceCommand — projects/…/jobs/$id/trace
• buildMergeRequestForBranchCommand — the worst of the four, because the slug
  precedes a real query string, so a slug-borne & or ? merged into
  parameters that already existed

The fix uses URLEncoder.encode(repository, "UTF-8").replace("+", "%20"). The
.replace step is required: URLEncoder is form-encoding, so a space would
otherwise arrive as +, which means a literal plus inside a path.

Scope held

encodedQueryValue and the four --repo builders are untouched. Those hand the
repository to glab as a raw process argument, never into a path this code
builds, so encoding them would change what glab receives for no reason this
issue names.

Testing

Two regression tests in core/test/GitLabCiTest.scala, both proved RED before
being accepted:

• "a repository slug cannot end the api path or add a parameter" drives the
  slug group/pro?a=1&b#x%z w through buildMergeRequestCommand.
• "a repository slug cannot add a query parameter ahead of source_branch"
  drives the same slug through buildMergeRequestForBranchCommand and pins the
  encoded segment against the ?source_branch= that follows it.

No-regression proof: the existing assertions pinning group%2Fsub%2Fproject
pass unchanged. Full percent-encoding is byte-identical to /-only escaping for
a legal slug, so the fix carries no risk for a correctly configured project.

• ./iw ./test unit → exit 0 (core.test 186/186, dashboard.test 241/241)
• ./iw ./test lint → exit 0

Code review: 1 iteration, 0 critical, 0 warnings.

Release notes

project-management/issues/IW-558/release-notes.md (Czech, user-facing).

Follow-up

Filed as #562 — GitRemote.extractRepositoryPath and the config parser
disagree on which characters a repository slug may hold.

Closes #558

🤖 Generated with Claude Code

## Summary `GitLabClient.encodedRepo` escaped one character, `/`. GitLab's REST API needs the whole `namespace/project` slug as a single percent-encoded path segment, so every other URL-significant character passed through raw. A slug carrying `?`, `#`, `&`, `%` or a space therefore ended the path or changed its meaning, and the request addressed a project the caller never named. No exception, no error message — a wrong request, which is what kept it unnoticed. `encodedRepo` now percent-encodes the slug as one path segment. One central change fixes all four `glab api` path builders; no call site was edited. ## Defect fixed **Phase 1 — `encodedRepo` leaves URL-significant characters raw in four `glab api` paths** (#561, merged) The four affected builders: - `buildPipelineJobsCommand` — `projects/…/pipelines/$id/jobs` - `buildMergeRequestCommand` — `projects/…/merge_requests/$n` - `buildJobTraceCommand` — `projects/…/jobs/$id/trace` - `buildMergeRequestForBranchCommand` — the worst of the four, because the slug precedes a real query string, so a slug-borne `&` or `?` merged into parameters that already existed The fix uses `URLEncoder.encode(repository, "UTF-8").replace("+", "%20")`. The `.replace` step is required: `URLEncoder` is form-encoding, so a space would otherwise arrive as `+`, which means a literal plus inside a path. ## Scope held `encodedQueryValue` and the four `--repo` builders are untouched. Those hand the repository to glab as a raw process argument, never into a path this code builds, so encoding them would change what glab receives for no reason this issue names. ## Testing Two regression tests in `core/test/GitLabCiTest.scala`, both proved RED before being accepted: - *"a repository slug cannot end the api path or add a parameter"* drives the slug `group/pro?a=1&b#x%z w` through `buildMergeRequestCommand`. - *"a repository slug cannot add a query parameter ahead of source_branch"* drives the same slug through `buildMergeRequestForBranchCommand` and pins the encoded segment against the `?source_branch=` that follows it. No-regression proof: the existing assertions pinning `group%2Fsub%2Fproject` pass unchanged. Full percent-encoding is byte-identical to `/`-only escaping for a legal slug, so the fix carries no risk for a correctly configured project. - `./iw ./test unit` → exit 0 (core.test 186/186, dashboard.test 241/241) - `./iw ./test lint` → exit 0 Code review: 1 iteration, 0 critical, 0 warnings. ## Release notes `project-management/issues/IW-558/release-notes.md` (Czech, user-facing). ## Follow-up Filed as #562 — `GitRemote.extractRepositoryPath` and the config parser disagree on which characters a repository slug may hold. Closes #558 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude added 14 commits 2026-09-14 22:27:45 +00:00

workflow(dx): Create diagnostic analysis for IW-558 ... 79b12baf91

GitLabClient.encodedRepo escapes only /, so a repo slug with ? # & or %
corrupts every glab api path

Artifacts:
- analysis.md

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011M2HjEYoJpcfD43KYP6zxt

chore(IW-558): write review-state for the diagnostic analysis ... 6f238a03fe

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011M2HjEYoJpcfD43KYP6zxt

chore(IW-558): update review-state to tasks_ready dc05d8974d

workflow(dx): Create task index for IW-558 ... 4efd912796

GitLabClient.encodedRepo escapes only /, so a repo slug with ? # & or %
corrupts every glab api path

Artifacts:
- tasks.md
- review-state.json (tasks_ready)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011M2HjEYoJpcfD43KYP6zxt

docs(IW-558): intake verdict — agent-ready ... 04b6a3ef32

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011M2HjEYoJpcfD43KYP6zxt

Phase 1: context ready ... cd12037ced

Issue: IW-558
Phase: 1 - encodedRepo leaves URL-significant characters raw in four glab api paths

This commit marks the checkpoint for phase 1 context generation.
Use dx-fix IW-558 to return to this point.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

chore(IW-558): update review-state to context_ready cd0b111679

workflow(dx): Generate Phase 1 tasks for IW-558 ... 8b63bcc099

encodedRepo leaves URL-significant characters raw in four glab api paths

Artifacts:
- phase-01-tasks.md

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

chore(IW-558): update review-state to tasks_ready 0a833c83d4

Phase 1: Percent-encode the repository slug as one glab api path segment (#561) e3cc2b9cc6

chore(IW-558): update review-state for phase 01 0e3dcb3928

chore(IW-558): mark phase 01 complete in tasks.md 4bb3dcad1d

workflow(IW-558): file follow-up to tracker as #562 ... 1d315b0841

The FOLLOW-UPS.md line about extractRepositoryPath vs the config parser
disagreeing on valid slug characters is now tracker issue #562.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs(IW-558): add Czech release notes ... 78445848a6

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

mph added 1 commit 2026-09-14 22:28:50 +00:00

chore(IW-558): update review-state to all_complete 224ed1aead

mph merged commit 3ff0e4119c into main 2026-09-15 09:33:16 +00:00

mph referenced this pull request from a commit 2026-09-15 09:33:17 +00:00

Merge pull request 'IW-558: Percent-encode the GitLab repository slug as one api path segment' (#563) from IW-558 into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent-ready

  

bug

Something isn't working

  

contract

Run the tool-contract suite on this PR

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

needs-human

  

needs-input

Intake asked the human a question on the issue; waiting for the answer

  

question

Further information is requested

  

wontfix

This will not be worked on

No labels

agent-ready

bug

contract

documentation

duplicate

enhancement

good first issue

help wanted

invalid

needs-human

needs-input

question

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

iterative-works/iw-cli!563

No description provided.