Repository navigation
Unvalidated Dataverse API path input across plugins #707
Description
The apiPath parameter is directly interpolated into the HTTP request URL. If an AI agent hallucinates or is maliciously prompted to supply a path containing directory traversal vectors (e.g., ../), it could theoretically escape the expected API scope. This issue tracks the remediation across power-pages, model-apps, and mobile-apps plugins.
Activity
model-apps 2.14.0: Notes timeline, sub-grid placement, lookup and fil…
akshaymaloo commentedon Oct 13, 2026
The model-apps part of this is fixed in model-apps 2.14.0 (#722):
dataverse-request.jsnow keeps the path under the Web API root. A path whose..segments would leave/api/data/v9.2/(written plainly, percent-encoded, or joined by an encoded slash) is refused before a token is read, and the paths that were accepted before still answer.The other plugins' scripts are for their owners, so I'm leaving this open for them.
Tharun-Varshan-S commentedon Oct 14, 2026
Could I know that if there is any other issue I can work on