From bb7eebf502f0aa4c3045508def949c9c2124cdf1 Mon Sep 17 00:00:00 2001 From: shoko <270575765+shokollm@users.noreply.github.com> Date: Thu, 26 Mar 2026 19:11:59 +0000 Subject: [PATCH] security(polymarket-browse): use proper URL encoding for --search parameter - Import quote from urllib.parse - Replace q.replace(' ', '%20') with quote(q, safe='') - Properly encodes: &, =, %, +, #, ?, and other special chars - Prevents URL injection attacks --- skills/polymarket-browse/scripts/browse.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/skills/polymarket-browse/scripts/browse.py b/skills/polymarket-browse/scripts/browse.py index e1af87b..1cac50e 100644 --- a/skills/polymarket-browse/scripts/browse.py +++ b/skills/polymarket-browse/scripts/browse.py @@ -13,7 +13,7 @@ import os from concurrent.futures import ThreadPoolExecutor, as_completed from datetime import datetime, timezone, timedelta from typing import Any, Callable, TypedDict -from urllib.parse import urlencode +from urllib.parse import urlencode, quote from urllib.request import urlopen, Request @@ -166,7 +166,7 @@ def fetch_page( ) -> dict[str, Any] | None: base = "https://gamma-api.polymarket.com/public-search" url = ( - f"{base}?q={q.replace(' ', '%20')}&limit={PAGE_SIZE}&page={page}" + f"{base}?q={quote(q, safe='')}&limit={PAGE_SIZE}&page={page}" f"&search_profiles=false&search_tags=false" f"&keep_closed_markets=0&events_status=active&cache=false" )