Evan JarrettandClaude Opus 5 cecb8879de billing: escape the DID before interpolating it into a Stripe search ...

findCustomerByDID built its search query with fmt.Sprintf, so the DID was
interpolated into a quoted Stripe search string unescaped. DIDs arriving
here are OAuth-validated and the DID grammar forbids quotes, so this is
not currently exploitable, but the query's safety depended on a validator
several layers away rather than on anything visible at the call site.

Escape backslash and single quote the way Stripe's search grammar
specifies.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-09 20:51:31 -05:00

..

appview

appview: point the footer Bluesky link at the DID

2026-08-09 20:49:24 -05:00

atproto

add SBOM package diffing, verify hold-service captain records

2026-06-13 12:49:03 -05:00

auth

auth: let over-quota users delete by granting the non-push subset

2026-08-09 16:49:44 -05:00

billing

billing: escape the DID before interpolating it into a Stripe search

2026-08-09 20:51:31 -05:00

config

convert alert to modal. go fix the codebase

2026-05-16 11:59:47 -05:00

credhelper

credhelper: make config writes non-destructive

2026-08-02 19:19:40 -05:00

hold

admin: resolve handles after limiting top users

2026-08-09 20:22:46 -05:00

labeler

convert alert to modal. go fix the codebase

2026-05-16 11:59:47 -05:00

logging

convert alert to modal. go fix the codebase

2026-05-16 11:59:47 -05:00

s3

hold/gc: sweep orphaned scan and image config records

2026-08-08 21:24:00 -05:00

testpds

add more integration tests

2026-05-11 19:53:13 -05:00