Skip to content

fix(github-plugin): encode repo paths in raw.githubusercontent.com URLs - #472

Open
deanrie wants to merge 1 commit into
cursor:mainfrom
deanrie:github-file-path-encoding
Open

deanrie wants to merge 1 commit into
cursor:mainfrom
deanrie:github-file-path-encoding

Conversation

@deanrie

@deanrie deanrie commented Oct 25, 2026

Copy link
Copy Markdown

What

fetchGitHubFile in lib/github-plugin/parse.ts builds the raw-content URL by interpolating the tree path as it comes from the GitHub tree API, which is not percent-encoded:

const url = `https://raw.githubusercontent.com/${owner}/${repo}/HEAD/${path}`;

A # in the path starts a URL fragment, a ? a query, and a % a malformed escape. rules/c#.mdc is requested as .../rules/c, gets a 404, fetchGitHubFile returns null, and the rule is skipped without a message. A sub-plugin directory with such a character loses its plugin.json the same way, and the relative logo path is built with the same template.

Checked against a live repo: flyeric0212/cursor-rules has languages/c#.mdc. The unencoded URL returns 404 at /languages/c; the segment-encoded URL returns 200. Plain paths (README.md, .cursor-plugin/marketplace.json, advisor/.cursor-plugin/plugin.json on cursor/plugins) return the same status either way.

This is the fetch-side sibling of #467, which escapes the directory prefix when matching the tree. The two touch different hunks of the file and merge cleanly together.

Fix

One rawGitHubUrl(owner, repo, path) helper percent-encodes each path segment and keeps the slashes between them, used by fetchGitHubFile and by the relative-logo branch. Plain paths produce the same URL as before.

The repo has no test runner. tsc --noEmit -p apps/cursor/tsconfig.json reports the same single pre-existing error as main (platform in AgentOptions in scan.ts) and nothing new; biome check on the file is clean.

fetchGitHubFile and the relative logo URL interpolated tree paths into the
raw URL as they came from the GitHub tree API, unencoded. A path with a #
stopped at the fragment, a ? at the query, and a % was read as a broken
escape, so a rule such as rules/c#.mdc fetched rules/c, got a 404, and was
dropped from the import without a message. A sub-plugin directory with such
a character lost its plugin.json the same way.

Each path segment is now percent-encoded and the slashes between them
kept, through one rawGitHubUrl helper used by both call sites. Plain paths
produce the same URL as before.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant