Merge pull request #3007 from orbisai0security/fix-fix-v-006-graphql-injection-sanitization

fix: use subprocess instead of os.system in fetch_github_stars.py

Author: vinta

website/fetch_github_stars.py

@@ -19,6 +19,10 @@
 GRAPHQL_URL = "https://api.github.com/graphql"
 BATCH_SIZE = 50
 
+# Allowlist for valid GitHub owner/repo name characters.
+# GitHub usernames and repo names only allow letters, digits, hyphens, underscores, and dots.
+_GITHUB_NAME_RE = re.compile(r"^[a-zA-Z0-9._-]+$")
+
 
 def extract_github_repos(text: str) -> set[str]:
     """Extract unique owner/repo pairs from GitHub URLs in markdown text."""
@@ -46,7 +50,7 @@ def build_graphql_query(repos: list[str]) -> str:
     parts = []
     for i, repo in enumerate(repos):
         owner, name = repo.split("/", 1)
-        if '"' in owner or '"' in name:
+        if not _GITHUB_NAME_RE.match(owner) or not _GITHUB_NAME_RE.match(name):
             continue
         parts.append(
             f'repo_{i}: repository(owner: "{owner}", name: "{name}") '