[shreyanshjain7174]

Plan

Security fix found while reviewing #43. buildURL put agent-controlled params into path templates without escaping.

Impact before this fix:

• An agent could send {"repo": "../../admin/users"} or values with ? or #. That reached other endpoints on the SaaS host with the vault-injected credential attached.
• A value containing another placeholder, such as {owner}, could be substituted again, depending on map iteration order.
• Bad params were only checked after the vault fetch and token refresh.

What changed

• buildURL scans the template once, left to right. Each placeholder is replaced once, never re-scanned.

• Values are escaped with url.PathEscape as single path segments.

• Rejected with 400 bad_request and a receipt:

  • missing params and empty values;
  • . and ..;
  • objects, arrays, null and non-integer numbers.

  Large integers keep their exact text.

• After building, the final URL must keep the base URL's scheme and host.

• Templates with a placeholder after ? fail at registry load, and buildURL rejects them too. PathEscape is wrong for query values.

• URL building now runs right after the action lookup, before any vault access. Bad params never trigger an OAuth refresh. An invalid base_url is an operator error: 500 internal, with a receipt.

• README and docs/registry.md say path params are escaped as single segments.

Validation

• go build ./...: passed
• go vet ./...: passed
• go test -race ./...: passed
• semgrep --config auto --error --quiet internal/gateway internal/registry: passed, no findings

Tests cover:

• traversal, slash, query and fragment characters;
• %2e%2e (sent as %252e%252e), checked on the raw request line at the upstream;
• placeholder-in-value, run 100 times;
• missing params, wrong types, large ints and unicode;
• query placeholders rejected at load;
• zero vault and refresh calls for bad params;
• all 39 shipped connector templates.

Review

Reviewed by a second model (Claude Opus 5.5). Approved. Its 2 minors (query placeholders, check order) are fixed here. The third, the same old code in unused internal/proxy, goes away in the dead-code cleanup PR.

Compatibility

A custom connector that passed slashes inside one param must move the separators into its template. No shipped connector does this.