From 7b86627727d0b6741cc23904d6092e580a403b41 Mon Sep 17 00:00:00 2001
From: Noah Brier <nbrier@gmail.com>
Date: Sun, 14 Sep 2025 17:15:52 -0400
Subject: [PATCH] fix: address security concerns from PR review

- Add URL validation to download-attachment (only allow http/https)
- Add filename sanitization to prevent path traversal attacks
- Add timeouts to download commands (30 seconds)
- Add branch name sanitization in pull-request command
- Check for existing branches to avoid conflicts
- Add check for current feature branch

Addresses security concerns raised by Claude in PR #1 review
---
 .claude/commands/download-attachment.md | 22 +++++++++++++++++-----
 .claude/commands/pull-request.md        | 12 +++++++++++-
 2 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/.claude/commands/download-attachment.md b/.claude/commands/download-attachment.md
index dce60b7..cc60516 100644
--- a/.claude/commands/download-attachment.md
+++ b/.claude/commands/download-attachment.md
@@ -17,17 +17,29 @@ Download files from URLs to attachments folder and organize them with descriptiv
 
 You are tasked with downloading files from URLs and organizing them in the Obsidian vault attachments folder.
 
-### Step 1: Parse URLs
+### Step 1: Parse and Validate URLs
 Extract the URL(s) from the user's input. Handle multiple URLs if provided.
+- **Validate URL scheme**: Only allow http:// or https:// URLs
+- **Reject invalid URLs**: file://, ftp://, or malformed URLs
+- **Example validation**:
+```bash
+if [[ ! "$url" =~ ^https?:// ]]; then
+  echo "Error: Only HTTP/HTTPS URLs are allowed"
+  exit 1
+fi
+```
 
 ### Step 2: Download Files
 For each URL:
 ```bash
-# Create temp filename based on URL
-# Use wget or curl to download
-wget -O "05_Attachments/[filename]" "[url]"
+# Sanitize filename to prevent path traversal
+# Remove ../ and other dangerous characters
+filename=$(basename "$url" | sed 's/[^a-zA-Z0-9._-]/_/g')
+
+# Use wget or curl to download with timeout
+wget --timeout=30 -O "05_Attachments/$filename" "$url"
 # or
-curl -L "[url]" -o "05_Attachments/[filename]"
+curl --max-time 30 -L "$url" -o "05_Attachments/$filename"
 ```
 
 ### Step 3: Verify Downloads
diff --git a/.claude/commands/pull-request.md b/.claude/commands/pull-request.md
index e96918c..0a79e7c 100644
--- a/.claude/commands/pull-request.md
+++ b/.claude/commands/pull-request.md
@@ -13,12 +13,22 @@ Automate the entire pull request workflow: create branch, stage changes, commit
    - Check for uncommitted changes to include
    - Verify GitHub CLI (`gh`) is available
    - Get current branch as base branch
+   - If already on feature branch, ask: "Create PR from current branch?"
 
 ### 2. **Create Feature Branch**
    ```bash
    # Generate branch name from PR title or use provided name
+   # Sanitize branch name: lowercase, replace spaces with hyphens, remove special chars
+   branch_name=$(echo "$branch_name" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]/-/g' | sed 's/--*/-/g')
+
+   # Check if branch already exists
+   if git show-ref --verify --quiet refs/heads/$branch_name; then
+     echo "Branch $branch_name already exists, using alternative name"
+     branch_name="${branch_name}-$(date +%s)"
+   fi
+
    # Format: feature/short-description or fix/issue-name
-   git checkout -b feature/[branch-name]
+   git checkout -b $branch_name
    ```
 
 ### 3. **Stage and Review Changes**