From 9cde01cbb1d9021f036eb44ceadc35ae248a149f Mon Sep 17 00:00:00 2001
From: tomaioo <hongsaygio.com@gmail.com>
Date: Fri, 22 May 2026 17:15:01 -0700
Subject: [PATCH 1/2] fix(security): 2 improvements across 2 files

- Security: Potential Command Injection via GraphQL Query Construction
- Security: Unsafe JSON Parsing without Validation

Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com>
---
 bamboo/detect-pr.js | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/bamboo/detect-pr.js b/bamboo/detect-pr.js
index 69541828ecba..6fc38314dccd 100755
--- a/bamboo/detect-pr.js
+++ b/bamboo/detect-pr.js
@@ -6,24 +6,24 @@ const graphql = require('@octokit/graphql');
 // Query Github API for first commit on target ref and see if it has an associated pull request
 
 async function getPrsForRef(headRefName, baseRefName) {
-  const queryResponse = await graphql(`{
-    repository(owner:"nasa", name:"cumulus") {
+  const queryResponse = await graphql(`
+    query($headRefName: String!) {
+      repository(owner:"nasa", name:"cumulus") {
         name
-        ref(qualifiedName: "${headRefName}") {
+        ref(qualifiedName: $headRefName) {
           name
           target {
-            ... on Commit{
+            ... on Commit {
               history(first: 1) {
-                nodes{
+                nodes {
                   id
                   associatedPullRequests(last: 100) {
-                    edges{
-                      node{
+                    edges {
+                      node {
                         title
                         state
                         headRefName
                         baseRefName
-                        }
                       }
                     }
                   }
@@ -32,7 +32,10 @@ async function getPrsForRef(headRefName, baseRefName) {
             }
           }
         }
-  }`, {
+      }
+    }
+  `, {
+    headRefName: `refs/heads/${headRefName}`,
     headers: {
       authorization: `token ${process.env.GITHUB_TOKEN}`,
     },

From e88ad6dd39ee8a80883cc079204392783c6b9ece Mon Sep 17 00:00:00 2001
From: tomaioo <hongsaygio.com@gmail.com>
Date: Fri, 22 May 2026 17:15:02 -0700
Subject: [PATCH 2/2] fix(security): 2 improvements across 2 files

- Security: Potential Command Injection via GraphQL Query Construction
- Security: Unsafe JSON Parsing without Validation

Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com>
---
 packages/api-client/src/cumulusApiClient.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/api-client/src/cumulusApiClient.ts b/packages/api-client/src/cumulusApiClient.ts
index 3b78a6b4ed74..fa8b6bef1e8f 100644
--- a/packages/api-client/src/cumulusApiClient.ts
+++ b/packages/api-client/src/cumulusApiClient.ts
@@ -46,9 +46,9 @@ export async function invokeApi(
         throw new Error('No payload received from lambda invocation');
       }
 
-      const parsedPayload = JSON.parse(new TextDecoder('utf-8').decode(apiOutput.Payload));
+      let parsedPayload; try { parsedPayload = JSON.parse(new TextDecoder('utf-8').decode(apiOutput.Payload)); } catch (e) { throw new CumulusApiClientError(`Error parsing lambda payload: ${e.message}`, 500, undefined); }
 
-      if (parsedPayload?.errorMessage?.includes('Task timed out')) {
+      if (parsedPayload && parsedPayload.errorMessage && parsedPayload.errorMessage.includes('Task timed out')) {
         throw new CumulusApiClientError(
           `Error calling ${payload.path}: ${parsedPayload.errorMessage}`,
           parsedPayload?.statusCode,
@@ -56,7 +56,7 @@ export async function invokeApi(
         );
       }
 
-      if (!expectedStatusCodesFlat.includes(parsedPayload?.statusCode)) {
+      if (parsedPayload && !expectedStatusCodesFlat.includes(parsedPayload.statusCode)) {
         throw new CumulusApiClientError(
           `${payload.path} returned ${parsedPayload.statusCode}: ${parsedPayload.body}`,
           parsedPayload?.statusCode,