Skip to content

fix: Encode userId path parameter in user API key methods #1664

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devin-ai-integration wants to merge 3 commits into
base: main
Choose a base branch
from
Open

fix: Encode userId path parameter in user API key methods #1664

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bf39c99
Encode userId path parameter in user API key methods
devin-ai-integration[bot] Jul 23, 2026
088d805
Encode userId in remaining user-management methods
devin-ai-integration[bot] Jul 23, 2026
17708af
Encode userId in updateUser path
devin-ai-integration[bot] Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 68 additions & 0 deletions src/user-management/user-management.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,17 @@ describe('UserManagement', () => {
locale: 'en-US',
});
});

it('encodes the userId so it cannot escape the route template', async () => {
fetchOnce(userFixture);

await workos.userManagement.getUser('../../organizations/org_01TARGET?');

const url = new URL(fetchURL() as string);
expect(url.pathname).toBe(
'/user_management/users/..%2F..%2Forganizations%2Forg_01TARGET%3F',
);
});
});

describe('getUserByExternalId', () => {
Expand Down Expand Up @@ -2022,6 +2033,20 @@ describe('UserManagement', () => {
});
});

it('encodes the userId so it cannot escape the route template', async () => {
fetchOnce(userFixture);

await workos.userManagement.updateUser({
userId: '../../organizations/org_01TARGET?',
firstName: 'Dane',
});

const url = new URL(fetchURL() as string);
expect(url.pathname).toBe(
'/user_management/users/..%2F..%2Forganizations%2Forg_01TARGET%3F',
);
});

describe('when only one property is provided', () => {
it('sends a updateUser request', async () => {
fetchOnce(userFixture);
Expand Down Expand Up @@ -2130,6 +2155,19 @@ describe('UserManagement', () => {
expect(fetchURL()).toContain(`/user_management/users/${userId}`);
expect(resp).toBeUndefined();
});

it('encodes the userId so it cannot escape the route template', async () => {
fetchOnce();

await workos.userManagement.deleteUser(
'../../organizations/org_01TARGET?',
);

const url = new URL(fetchURL() as string);
expect(url.pathname).toBe(
'/user_management/users/..%2F..%2Forganizations%2Forg_01TARGET%3F',
);
});
});

describe('listUserApiKeys', () => {
Expand Down Expand Up @@ -2184,6 +2222,19 @@ describe('UserManagement', () => {
organization_id: 'org_01EHZNVPK3SFK441A1RGBFSHRT',
});
});

it('encodes the userId so it cannot escape the route template', async () => {
fetchOnce(listUserApiKeysFixture);

await workos.userManagement.listUserApiKeys(
'../../organizations/org_01TARGET/api_keys?',
);

const url = new URL(fetchURL() as string);
expect(url.pathname).toBe(
'/user_management/users/..%2F..%2Forganizations%2Forg_01TARGET%2Fapi_keys%3F/api_keys',
);
});
});

describe('createUserApiKey', () => {
Expand Down Expand Up @@ -2241,6 +2292,23 @@ describe('UserManagement', () => {
'Idempotency-Key': 'the-idempotency-key',
});
});

it('encodes the userId so it cannot escape the route template', async () => {
fetchOnce(createUserApiKeyFixture, { status: 201 });

await workos.userManagement.createUserApiKey(
'../../../organizations/org_01TARGET/api_keys?',
{
name: 'attacker-key',
organizationId: 'org_01EHZNVPK3SFK441A1RGBFSHRT',
},
);

const url = new URL(fetchURL() as string);
expect(url.pathname).toBe(
'/user_management/users/..%2F..%2F..%2Forganizations%2Forg_01TARGET%2Fapi_keys%3F/api_keys',
);
});
});

describe('getUserIdentities', () => {
Expand Down
31 changes: 18 additions & 13 deletions src/user-management/user-management.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -253,7 +253,7 @@ export class UserManagement {
*/
async getUser(userId: string): Promise<User> {
const { data } = await this.workos.get<UserResponse>(
`/user_management/users/${userId}`,
`/user_management/users/${encodeURIComponent(userId)}`,
);

return deserializeUser(data);
Expand Down Expand Up @@ -860,7 +860,7 @@ export class UserManagement {
userId,
}: SendVerificationEmailOptions): Promise<{ user: User }> {
const { data } = await this.workos.post<{ user: UserResponse }>(
`/user_management/users/${userId}/email_verification/send`,
`/user_management/users/${encodeURIComponent(userId)}/email_verification/send`,
{},
);

Expand Down Expand Up @@ -931,9 +931,12 @@ export class UserManagement {
const { data } = await this.workos.post<
{ user: UserResponse },
SerializedVerifyEmailOptions
>(`/user_management/users/${userId}/email_verification/confirm`, {
code,
});
>(
`/user_management/users/${encodeURIComponent(userId)}/email_verification/confirm`,
{
code,
},
);

return { user: deserializeUser(data.user) };
}
Expand Down Expand Up @@ -1005,7 +1008,7 @@ export class UserManagement {
*/
async updateUser(payload: UpdateUserOptions): Promise<User> {
const { data } = await this.workos.put<UserResponse>(
`/user_management/users/${payload.userId}`,
`/user_management/users/${encodeURIComponent(payload.userId)}`,
serializeUpdateUserOptions(payload),
);

Expand All @@ -1028,14 +1031,14 @@ export class UserManagement {
return new AutoPaginatable(
await fetchAndDeserialize<SessionResponse, Session>(
this.workos,
`/user_management/users/${userId}/sessions`,
`/user_management/users/${encodeURIComponent(userId)}/sessions`,
deserializeSession,
options ? serializeListSessionsOptions(options) : undefined,
),
(params) =>
fetchAndDeserialize<SessionResponse, Session>(
this.workos,
`/user_management/users/${userId}/sessions`,
`/user_management/users/${encodeURIComponent(userId)}/sessions`,
deserializeSession,
params,
),
Expand All @@ -1051,7 +1054,9 @@ export class UserManagement {
* @throws {NotFoundException} 404
*/
async deleteUser(userId: string) {
await this.workos.delete(`/user_management/users/${userId}`);
await this.workos.delete(
`/user_management/users/${encodeURIComponent(userId)}`,
);
}

/**
Expand All @@ -1074,14 +1079,14 @@ export class UserManagement {
return new AutoPaginatable(
await fetchAndDeserialize<SerializedUserApiKey, UserApiKey>(
this.workos,
`/user_management/users/${userId}/api_keys`,
`/user_management/users/${encodeURIComponent(userId)}/api_keys`,
deserializeUserApiKey,
serializedOptions,
),
(params) =>
fetchAndDeserialize<SerializedUserApiKey, UserApiKey>(
this.workos,
`/user_management/users/${userId}/api_keys`,
`/user_management/users/${encodeURIComponent(userId)}/api_keys`,
deserializeUserApiKey,
params,
),
Expand Down Expand Up @@ -1109,7 +1114,7 @@ export class UserManagement {
SerializedUserApiKeyWithValue,
ReturnType<typeof serializeCreateUserApiKeyOptions>
>(
`/user_management/users/${userId}/api_keys`,
`/user_management/users/${encodeURIComponent(userId)}/api_keys`,
serializeCreateUserApiKeyOptions(options),
requestOptions,
);
Expand All @@ -1130,7 +1135,7 @@ export class UserManagement {
}

const { data } = await this.workos.get<RawIdentityResponse[]>(
`/user_management/users/${userId}/identities`,
`/user_management/users/${encodeURIComponent(userId)}/identities`,
);

return deserializeIdentities(data);
Expand Down