mirror of
https://github.com/anthropics/claude-code-action.git
synced 2026-01-22 22:44:13 +08:00
Add trigger-time validation for issue/PR body content to prevent attackers from exploiting a race condition where they edit the body between when an authorized user triggers @claude and when Claude processes the request. The existing filterCommentsToTriggerTime() already protected comments - this extends the same pattern to the main issue/PR body via isBodySafeToUse(). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>
130 lines
2.4 KiB
TypeScript
130 lines
2.4 KiB
TypeScript
// GraphQL queries for GitHub data
|
|
|
|
export const PR_QUERY = `
|
|
query($owner: String!, $repo: String!, $number: Int!) {
|
|
repository(owner: $owner, name: $repo) {
|
|
pullRequest(number: $number) {
|
|
title
|
|
body
|
|
author {
|
|
login
|
|
}
|
|
baseRefName
|
|
headRefName
|
|
headRefOid
|
|
createdAt
|
|
updatedAt
|
|
lastEditedAt
|
|
additions
|
|
deletions
|
|
state
|
|
commits(first: 100) {
|
|
totalCount
|
|
nodes {
|
|
commit {
|
|
oid
|
|
message
|
|
author {
|
|
name
|
|
email
|
|
}
|
|
}
|
|
}
|
|
}
|
|
files(first: 100) {
|
|
nodes {
|
|
path
|
|
additions
|
|
deletions
|
|
changeType
|
|
}
|
|
}
|
|
comments(first: 100) {
|
|
nodes {
|
|
id
|
|
databaseId
|
|
body
|
|
author {
|
|
login
|
|
}
|
|
createdAt
|
|
updatedAt
|
|
lastEditedAt
|
|
isMinimized
|
|
}
|
|
}
|
|
reviews(first: 100) {
|
|
nodes {
|
|
id
|
|
databaseId
|
|
author {
|
|
login
|
|
}
|
|
body
|
|
state
|
|
submittedAt
|
|
updatedAt
|
|
lastEditedAt
|
|
comments(first: 100) {
|
|
nodes {
|
|
id
|
|
databaseId
|
|
body
|
|
path
|
|
line
|
|
author {
|
|
login
|
|
}
|
|
createdAt
|
|
updatedAt
|
|
lastEditedAt
|
|
isMinimized
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`;
|
|
|
|
export const ISSUE_QUERY = `
|
|
query($owner: String!, $repo: String!, $number: Int!) {
|
|
repository(owner: $owner, name: $repo) {
|
|
issue(number: $number) {
|
|
title
|
|
body
|
|
author {
|
|
login
|
|
}
|
|
createdAt
|
|
updatedAt
|
|
lastEditedAt
|
|
state
|
|
comments(first: 100) {
|
|
nodes {
|
|
id
|
|
databaseId
|
|
body
|
|
author {
|
|
login
|
|
}
|
|
createdAt
|
|
updatedAt
|
|
lastEditedAt
|
|
isMinimized
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`;
|
|
|
|
export const USER_QUERY = `
|
|
query($login: String!) {
|
|
user(login: $login) {
|
|
name
|
|
}
|
|
}
|
|
`;
|