Skip to content

fix: escape file paths in GraphQL expressions to prevent query syntax errors#201

Open
njlazzar-su wants to merge 2 commits intoentrius:testfrom
njlazzar-su:fix/graphql-expression-injection
Open

fix: escape file paths in GraphQL expressions to prevent query syntax errors#201
njlazzar-su wants to merge 2 commits intoentrius:testfrom
njlazzar-su:fix/graphql-expression-injection

Conversation

@njlazzar-su
Copy link
Contributor

Summary

Escape file paths before interpolating them into GraphQL query strings to prevent syntax errors.

Problem

In both fetch_file_contents_batch() and fetch_file_contents_with_base(), file paths from PRs are interpolated directly into GraphQL expression strings using f-strings:

expression = f"{head_sha}:{path}"
file_fields.append(f"file{i}: object(expression: \"{expression}\") {{ ... }}")

If a filename contains double quotes (e.g., src/"quoted"/file.py) or backslashes (common in Windows-originated PRs), the resulting GraphQL query will have broken syntax. This causes the entire batch file fetch to fail, and all files in the PR receive a score of 0 (since content_pair will be None).

Fix

Escape backslashes and double quotes in file paths before interpolation:

safe_path = path.replace("\\", "\\\\").replace("\"" , "\\\"")

Applied to both fetch_file_contents_batch() and fetch_file_contents_with_base().

Impact

Without this fix, any PR containing files with special characters in their paths would silently score 0 for all files in the batch fetch, potentially zeroing out an entire PR score.

… syntax errors

File paths are interpolated directly into GraphQL query strings via
f-strings without escaping. If a filename contains double quotes or
backslashes, the resulting GraphQL query will have broken syntax, causing
the file content fetch to fail silently (returns None, scoring the file as 0).

Escape backslashes and double quotes in file paths before interpolation
in both fetch_file_contents_batch() and fetch_file_contents_with_base().
@anderdc
Copy link
Collaborator

anderdc commented Feb 17, 2026

needs to target test branch

@njlazzar-su njlazzar-su changed the base branch from main to test February 17, 2026 17:04
@njlazzar-su
Copy link
Contributor Author

fixed

@njlazzar-su
Copy link
Contributor Author

Hi @anderdc what are next steps here?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

Comments