possible GitLab API injection attack

[rexim]

introduced in #154

[rexim]

Similar to #59

[aod]

https://github.com/tsoding/snitch/blob/72ba10cf8132634cb1406752ba6bd4f109d2a8ef/gitlab.go#L33-L37

Forgive me for my ignorance but what is the vulnerability? I would like to learn more about the possible API injection here.

[rexim]

@aod Nothing serious here otherwise I'd fix it right away. It's rather about sanitizing user's input. That todo.ID always contains that thingie in the parenthesis of the TODO line, hence it's a user input:

//    todo.ID
//       |
//       v
// TODO(#69): rewrite this in Rust
// ...

So, if I do something like this in the codebase

// TODO(#path/to/undesirable/api/sub-endpoint/)

and then something like snitch purge, snitch will inject this subpath and try to perform unintended API call.

I don't see how it could be exploited right now, but I think it's important to at least acknowledge this in a form of an issue, 'cause due to later changes this could become exploitable for something.