URL-encode query parameter values in APIClient._add_params #20

New Issue

cal · 2026-02-20T06:49:04Z

cal commented

2026-02-20 06:49:04 +00:00

Description

api/client.py:101 — _add_params builds query strings by simple string concatenation (f"{key}={value}"). Values are not passed through urllib.parse.quote. Path segments (object_id) are correctly encoded with quote(). If any query parameter value contains &, =, #, or spaces (e.g., a player name), the resulting URL will be malformed. Fix: use urllib.parse.urlencode(params).

File Locations

api/client.py:101

Labels

bug, security

Priority

high

## Description `api/client.py:101` — `_add_params` builds query strings by simple string concatenation (`f"{key}={value}"`). Values are not passed through `urllib.parse.quote`. Path segments (`object_id`) are correctly encoded with `quote()`. If any query parameter value contains `&`, `=`, `#`, or spaces (e.g., a player name), the resulting URL will be malformed. Fix: use `urllib.parse.urlencode(params)`. ## File Locations - `api/client.py:101` ## Labels bug, security ## Priority high

cal referenced this issue from a commit

2026-02-20 16:39:04 +00:00

fix: address 7 security issues across the codebase

cal commented

2026-02-20 16:48:26 +00:00

Addressed in commit f4be20a on next-release branch. Will be closed when merged to main.

Addressed in commit f4be20a on `next-release` branch. Will be closed when merged to main.

cal commented

2026-02-20 16:48:33 +00:00

Addressed in commit f4be20a on next-release branch. Will be closed when merged to main.

Addressed in commit `f4be20a` on `next-release` branch. Will be closed when merged to main.

cal closed this issue