Don't trust user input

Signed-off-by: Jonathan Mezach <jonathan.mezach@rr-wfm.com>
2023-02-17 15:41:10 +01:00
parent 9d00cd4558
commit 95d60d60d4
1 changed files with 6 additions and 1 deletions
@@ -117,6 +117,11 @@ export class OctopusDeployClient implements OctopusDeployApi {

  private async getApiUrl(projectId: string, releaseHistoryCount: number) {
    const proxyUrl = await this.discoveryApi.getBaseUrl('proxy');
-    return `${proxyUrl}${this.proxyPathBase}/projects/${projectId}/progression?releaseHistoryCount=${releaseHistoryCount}`;
+    const queryParameters = new URLSearchParams({
+      releaseHistoryCount: releaseHistoryCount.toString(),
+    });
+    return `${proxyUrl}${this.proxyPathBase}/projects/${encodeURIComponent(
+      projectId,
+    )}/progression?releaseHistoryCount=${queryParameters}`;
  }
 }