Add input validation to prevent SSRF/path traversal in API token handling

[Copilot]

User-controlled tokens (app_token, table_id, spreadsheet_token, sheet_id) were directly interpolated into API URLs without validation, allowing path traversal sequences like ../../../v3/admin to potentially access unintended endpoints.

Changes

New validation module (utils/validators.py)

• validate_token() - Rejects tokens containing .., /, \, or URL-encoded equivalents
• Specialized validators for each Feishu token type
• validate_file_path() - Path traversal protection for file inputs

API security hardening

• api/bitable.py - Added validation to list_fields, create_field, search_records, batch_create_records, batch_update_records, batch_delete_records
• api/sheet.py - Added validation to get_sheet_info, get_sheet_data, write_sheet_data, append_sheet_data, write_selective_columns, clear_sheet_range, set_dropdown_validation, set_cell_style

Tests

• 20 new test cases covering valid tokens, path traversal attempts, URL-encoded attacks, and type validation

Example

from utils.validators import validate_feishu_app_token, ValidationError

validate_feishu_app_token("bascnXXXXXXXX")  # OK
validate_feishu_app_token("../../../admin")  # Raises ValidationError

CodeQL scan: 0 alerts

Original prompt

全面评审、检查我的程序

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.