From 95d60d60d4e4f654dc7d2450c9fe4c66d2af485f Mon Sep 17 00:00:00 2001
From: Jonathan Mezach <jonathan.mezach@rr-wfm.com>
Date: Fri, 17 Feb 2023 15:41:10 +0100
Subject: [PATCH] Don't trust user input

Signed-off-by: Jonathan Mezach <jonathan.mezach@rr-wfm.com>
---
 plugins/octopus-deploy/src/api/index.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/plugins/octopus-deploy/src/api/index.ts b/plugins/octopus-deploy/src/api/index.ts
index dcdd881c10..8a29415dcc 100644
--- a/plugins/octopus-deploy/src/api/index.ts
+++ b/plugins/octopus-deploy/src/api/index.ts
@@ -117,6 +117,11 @@ export class OctopusDeployClient implements OctopusDeployApi {
 
   private async getApiUrl(projectId: string, releaseHistoryCount: number) {
     const proxyUrl = await this.discoveryApi.getBaseUrl('proxy');
-    return `${proxyUrl}${this.proxyPathBase}/projects/${projectId}/progression?releaseHistoryCount=${releaseHistoryCount}`;
+    const queryParameters = new URLSearchParams({
+      releaseHistoryCount: releaseHistoryCount.toString(),
+    });
+    return `${proxyUrl}${this.proxyPathBase}/projects/${encodeURIComponent(
+      projectId,
+    )}/progression?releaseHistoryCount=${queryParameters}`;
   }
 }