fix(miner): restrict check poller API origin

Author: Helios531

packages/gittensory-miner/lib/ci-poller.js

@@ -4,17 +4,32 @@ const defaultMaxIntervalMs = 5 * 60_000;
 const defaultMaxAttempts = 1;
 const githubApiVersion = "2022-11-28";
 
+function normalizeApiBaseUrl(value) {
+  if (value === undefined) return defaultApiBaseUrl;
+  if (typeof value !== "string" || !value.trim()) return defaultApiBaseUrl;
+  let parsed;
+  try {
+    parsed = new URL(value.trim());
+  } catch {
+    throw new Error("invalid_api_base_url");
+  }
+  if (parsed.protocol !== "https:" || parsed.hostname !== "api.github.com") {
+    throw new Error("invalid_api_base_url");
+  }
+  parsed.pathname = parsed.pathname.replace(/\/+$/, "");
+  parsed.search = "";
+  parsed.hash = "";
+  return parsed.toString().replace(/\/+$/, "");
+}
+
 function normalizePositiveInt(value, fallback, min, max) {
   if (!Number.isFinite(value)) return fallback;
   return Math.min(max, Math.max(min, Math.floor(value)));
 }
 
 function normalizeOptions(options = {}) {
   return {
-    apiBaseUrl:
-      typeof options.apiBaseUrl === "string" && options.apiBaseUrl.trim()
-        ? options.apiBaseUrl.trim().replace(/\/+$/, "")
-        : defaultApiBaseUrl,
+    apiBaseUrl: normalizeApiBaseUrl(options.apiBaseUrl),
     fetchFn: options.fetchFn ?? fetch,
     githubToken: typeof options.githubToken === "string" ? options.githubToken.trim() : "",
     maxAttempts: normalizePositiveInt(options.maxAttempts, defaultMaxAttempts, 1, 20),

test/unit/miner-ci-poller.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it, vi } from "vitest";
 import { pollCheckRuns } from "../../packages/gittensory-miner/lib/ci-poller.js";
 
-const API = "https://api.test";
+const API = "https://api.github.com";
 
 function jsonResponse(body: unknown, init: ResponseInit = {}) {
   return Response.json(body, init);
@@ -68,6 +68,40 @@ describe("miner CI check-run poller (#2323)", () => {
     ).toBe(true);
   });
 
+  it("rejects untrusted apiBaseUrl values before any token-bearing request", async () => {
+    const fetchFn = vi.fn();
+    for (const apiBaseUrl of [
+      "http://api.github.com",
+      "https://evil.example",
+      "https://api.github.com.evil.example",
+      "not a url",
+    ]) {
+      await expect(
+        pollCheckRuns("acme/widgets", 42, {
+          apiBaseUrl,
+          githubToken: "github-token",
+          fetchFn,
+        }),
+      ).rejects.toThrow("invalid_api_base_url");
+    }
+    expect(fetchFn).not.toHaveBeenCalled();
+  });
+
+  it("uses the default GitHub API base URL when apiBaseUrl is omitted", async () => {
+    const fetchFn = vi.fn(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url === "https://api.github.com/repos/acme/widgets/pulls/42") return prResponse("head-sha");
+      if (url === "https://api.github.com/repos/acme/widgets/commits/head-sha/check-runs?per_page=100&page=1") {
+        return checksResponse([checkRun("validate", "completed", "success")]);
+      }
+      return jsonResponse({}, { status: 404 });
+    });
+
+    await expect(pollCheckRuns("acme/widgets", 42, { fetchFn })).resolves.toMatchObject({
+      conclusion: "success",
+    });
+  });
+
   it("follows paginated check-run responses before aggregating failures (regression for #2621)", async () => {
     const pageOneChecks = Array.from({ length: 100 }, (_, index) =>
       checkRun(`success-${index}`, "completed", "success"),