fix: add some basic url validation

__tests__/utils.test.ts

@@ -1,8 +1,21 @@
 import { describe, expect, it } from 'vitest';
-import { isDBFile } from '../src/utils';
+import { isDBFile, validateGitUrl } from '../src/utils';
 
 describe('utils', () => {
   it('matches db files', () => {
     expect(isDBFile('__tests__/data/normal_2.db', ['*.db'])).toBe(true);
   });
+
+  it('should allow a proper repo', () => {
+    expect(() => {
+      validateGitUrl('https://github.com/rotki/action-sqldiff.git');
+      validateGitUrl('[email protected]:rotki/action-sqldiff.git');
+    }).to.not.throw();
+  });
+
+  it('should not allow a non repo', () => {
+    expect(() => {
+      validateGitUrl('smb://rotki');
+    }).to.throw(Error, 'Invalid repository URL: \'smb://rotki\'');
+  });
 });

src/changes.ts

@@ -5,13 +5,16 @@ import * as github from '@actions/github';
 import * as core from '@actions/core';
 import { getFiles, getGithubToken } from './input';
 import { NotAPullRequestError } from './errors';
-import { isDBFile } from './utils';
+import { isDBFile, validateGitUrl } from './utils';
 import { createDBDir } from './fs';
 import type { ComparedDatabases, FileVersions } from './types';
 import type { PullRequest } from '@octokit/webhooks-types/schema';
 
 function cloneRepo(target: 'head' | 'base', url: string, ref: string, sha: string): string {
   let cloneUrl = url;
+
+  validateGitUrl(cloneUrl);
+
   if (cloneUrl.startsWith('git'))
     cloneUrl = cloneUrl.replace('git', 'https');
 

src/utils.ts

@@ -3,3 +3,9 @@ import mm from 'micromatch';
 export function isDBFile(filename: string, patterns: string[]): boolean {
   return mm.isMatch(filename, patterns, { basename: true });
 }
+
+export function validateGitUrl(url: string): void {
+  const urlRegex = /^(https?:\/\/|git@[\w.-]+:)[\w#%+./:=@~-]+(.git)?$/;
+  if (!urlRegex.test(url))
+    throw new Error(`Invalid repository URL: '${url}'`);
+}