From 5c3ff1dabf644169f4bd74b215719f381e4fdb3f Mon Sep 17 00:00:00 2001 From: Grant Birkinbine Date: Thu, 12 Nov 2026 01:26:23 +0000 Subject: [PATCH] Validate the issue labeler's API key before sending requests (#60964) Trim surrounding whitespace from `OPENAI_API_KEY` and reject empty values or characters outside printable, non-space ASCII with `Invalid API key format`. Use the validated key in the request's `Authorization` header. GitOrigin-RevId: 61da9b4989b7cfbceb247ffbbeb6f6efd8413598 --- .github/scripts/issue_labeler.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/scripts/issue_labeler.py b/.github/scripts/issue_labeler.py index a69bf49cda..da8145aa30 100644 --- a/.github/scripts/issue_labeler.py +++ b/.github/scripts/issue_labeler.py @@ -148,12 +148,16 @@ class NoRedirects(HTTPRedirectHandler): def suggest_labels(issue): + api_key = os.environ["OPENAI_API_KEY"].strip() + if not api_key or not all("!" <= char <= "~" for char in api_key): + raise SystemExit("Invalid API key format") + request = Request( "https://api.openai.com/v1/responses", data=json.dumps(build_request(issue)).encode(), headers={ "Accept": "application/json", - "Authorization": "Bearer " + os.environ["OPENAI_API_KEY"], + "Authorization": "Bearer " + api_key, "Content-Type": "application/json", }, )