Skip to content

fix(jira): harden GitHub PR URL check against substring bypass #708

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 2 commits into from
Aug 19, 2026
Merged

fix(jira): harden GitHub PR URL check against substring bypass #708

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ca3ba67
fix(jira): harden GitHub PR URL check against substring bypass
cblecker Aug 18, 2026
b267fd3
run make update
cblecker Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .claude-plugin/marketplace.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@
"name": "jira",
"source": "./plugins/jira",
"description": "A plugin to automate tasks with Jira",
"version": "0.9.3",
"version": "0.9.4",
"category": "productivity",
"keywords": [
"jira",
Expand Down
10 changes: 5 additions & 5 deletions docs/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1490,7 +1490,7 @@ <h1>ai-helpers</h1>
{
"name": "jira",
"description": "A plugin to automate tasks with Jira",
"version": "0.9.2",
"version": "0.9.4",
"has_readme": true,
"commands": [
{
Expand Down Expand Up @@ -1645,8 +1645,8 @@ <h1>ai-helpers</h1>
},
{
"name": "create",
"description": "Create Jira issues — story, bug, epic, feature, initiative, task, or feature-request — with CNTRLPLANE, OCPBUGS, GCP, HyperShift, ARO, ROSA conventions and type-specific templates",
"description_html": "Create Jira issues — story, bug, epic, feature, initiative, task, or feature-request — with CNTRLPLANE, OCPBUGS, GCP, HyperShift, ARO, ROSA conventions and type-specific templates",
"description": "Create Jira issues — story, bug, epic, feature, initiative, task, risk, spike, or feature-request — with CNTRLPLANE, OCPBUGS, GCP, HyperShift, ARO, ROSA conventions and type-specific templates",
"description_html": "Create Jira issues — story, bug, epic, feature, initiative, task, risk, spike, or feature-request — with CNTRLPLANE, OCPBUGS, GCP, HyperShift, ARO, ROSA conventions and type-specific templates",
"meta": ""
},
{
Expand Down Expand Up @@ -1863,7 +1863,7 @@ <h1>ai-helpers</h1>
{
"name": "nid-team",
"description": "NI&D team PR triage and review workflow tools",
"version": "0.1.1",
"version": "0.1.2",
"has_readme": true,
"commands": [
{
Expand All @@ -1872,7 +1872,7 @@ <h1>ai-helpers</h1>
"description": "Send reminder comments on stale high-priority assigned PRs",
"description_html": "Send reminder comments on stale high-priority assigned PRs",
"synopsis": "/nid-team:nudge-prs [--dryrun] [--days 7] [--priority High,Urgent]",
"body_html": "Sends automated reminder comments on PRs that are assigned (Status=Assigned), high priority (PR Priority=High or Urgent), and have had no human activity for a configurable number of days. Determines whether the author or reviewer is blocking and @-mentions them in the comment."
"body_html": "Sends automated reminder comments on PRs that are assigned (Status=Assigned), high priority (PR Priority=High or Urgent), and have had no human activity for a configurable number of days."
},
{
"name": "sync-pr-dashboard",
Expand Down
2 changes: 1 addition & 1 deletion plugins/jira/.claude-plugin/plugin.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"name": "jira",
"description": "A plugin to automate tasks with Jira",
"version": "0.9.3",
"version": "0.9.4",
"author": {
"name": "github.com/openshift-eng"
}
Expand Down
2 changes: 1 addition & 1 deletion plugins/jira/skills/status-analysis/scripts/gather_status_data.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1071,7 +1071,7 @@ async def _gather_internal(self, session: Optional[aiohttp.ClientSession]) -> Di
obj = link.get("object", {})
url = obj.get("url", "")
title = obj.get("title", "")
if url and "github.com" in url and "/pull" in url:
if url and self.PR_PATTERN.fullmatch(url):
# Check if the PR title references a descendant issue
references_descendant = any(desc_key in title for desc_key in desc_keys)
if references_descendant:
Expand Down