fix: accept GitHub HTTPS remotes with a username or token

AL
9h ago
+39-3

Fixes #9099

Summary

  • GitHub HTTPS remotes with userinfo (https://user@github.com/..., https://user:token@github.com/...) are now recognized. Before this change, repo resolution failed with Repository at <path> has no GitHub remote.
  • Same fix in the shared parseGitHubRemote and in the two desktop copies of the pattern (normalizeGitHubRepoUrl, normalizeGitHubUrl).

Why / Context

Git, gh and GitHub accept userinfo in an HTTPS remote. Our HTTPS regex required github.com right after https://, so it returned null for these remotes. getGitHubRemotes then skipped them, and resolveGithubRepo threw. This also broke PR lookup and project setup.

How It Works

The HTTPS pattern gets an optional (?:[^@/]+@)? before the host. Because [^@/] cannot contain /, hosts like https://evil.com/@github.com/... and https://github.com.evil.com/... are still rejected. The returned URL is still built from owner and name only, so the username or token is never stored or shown.

Testing

  • New packages/shared/src/github-remote.test.ts (the regression test from the issue), plus a userinfo case in pull-request-url.test.ts.
  • Bun was not installed on the machine I worked on, so I did not run the suites, typecheck or lint locally. CI will run them. I checked the new regex with node: it matches both userinfo forms and a plain URL, and it rejects the two lookalike hosts above.

Summary by cubic

Accepts GitHub HTTPS remotes with a username or token (https://user@github.com/..., https://user:token@github.com/...) so repo resolution no longer fails with "has no GitHub remote." The username or token is dropped from the canonical URL and never stored.

  • The optional userinfo is allowed in parseGitHubRemote and the two desktop copies of the pattern (normalizeGitHubRepoUrl, normalizeGitHubUrl).
  • ?, #, and backslash are excluded from userinfo and the owner/repo captures, so lookalike URLs with @github.com in the query, fragment, or after a backslash, and paths like https://github.com/acme?next/foo, are rejected.

Summary by CodeRabbit

  • Bug Fixes
    • HTTPS GitHub repository URLs containing credentials are now recognized and normalized without retaining credential information. URLs without credentials continue to work as before.
    • URLs from other sites that include a GitHub-looking address in their query are not treated as GitHub repository URLs.
    • GitHub URLs containing queries, fragments, or backslashes in repository details are rejected.