security: validate version string in HttpSourceDownloader to prevent unexpected URL construction

[stack72]

Summary

The version parameter passed to HttpSourceDownloader.downloadAndExtract() is interpolated directly into a GitHub URL with no validation:

// src/infrastructure/source/http_source_downloader.ts:42-43
const tag = version.startsWith("v") ? version : `v${version}`;
return `${HttpSourceDownloader.GITHUB_BASE}/tags/${tag}.tar.gz`;

There is no check that version contains only safe URL characters. Characters such as #, ?, /, .., or URL-encoded sequences (e.g. %2F) could cause the constructed URL to resolve unexpectedly within the GitHub URL space.

Risk

The base URL is hardcoded to https://github.com/systeminit/swamp/archive/refs, so no SSRF to arbitrary hosts is possible. However, a crafted version string could:

• Escape the /tags/ path segment (e.g. version = "1.0/../../heads/main")
• Hit unintended GitHub archive endpoints

Recommended Fix

Add a validation guard at the top of downloadAndExtract() (or inside getArchiveUrl()) that rejects any version string not matching a safe pattern:

if (!/^[a-zA-Z0-9._-]+$/.test(version)) {
  throw new UserError(
    `Invalid version string "${version}": must contain only alphanumeric characters, dots, hyphens, and underscores.`,
  );
}

Add a test that calling downloadAndExtract with "../malicious" throws a UserError before any network request is made.

References

• src/infrastructure/source/http_source_downloader.ts — getArchiveUrl()

[stack72]

Proposed Fix

1. Add version validation in getArchiveUrl()

File: src/infrastructure/source/http_source_downloader.ts

Add a regex guard at the top of getArchiveUrl(), before the URL is constructed. Follows the existing SwampVersion.create() pattern from src/domain/repo/swamp_version.ts:

protected getArchiveUrl(version: string): string {
  if (!/^[a-zA-Z0-9._-]+$/.test(version)) {
    throw new UserError(
      \`Invalid version string "\${version}": must contain only alphanumeric characters, dots, hyphens, and underscores.\`,
    );
  }
  // ... existing logic unchanged
}

UserError is already imported in this file.

2. Add tests for invalid version strings

File: src/infrastructure/source/http_source_downloader_test.ts

Add tests that call downloadAndExtract directly (no TestDownloader override of getArchiveUrl) with malicious version strings and assert UserError is thrown before any network request is made. Test cases:

• ../malicious — path traversal with ..
• foo/../../heads/main — path traversal escaping /tags/
• version%2F.. — URL-encoded slash
• v1.0?ref=main — query string injection
• v1.0#fragment — fragment injection

Each should throw UserError with the "Invalid version string" message.