From 8102fa6675c005e2d4bf5079b09bb98dc5ed1f54 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Tue, 23 Jun 2026 18:32:55 +0100
Subject: [PATCH] Anchor regex and trim input

---
 lib/entry-points.js            |  4 ++--
 src/config/remote-file.test.ts | 13 +++++++++++++
 src/config/remote-file.ts      |  4 ++--
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/lib/entry-points.js b/lib/entry-points.js
index d1ce66f80..76c0e27d1 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -151449,9 +151449,9 @@ function getDefaultOwner(env) {
 }
 function parseRemoteFileAddress(env, configFile) {
   const format = new RegExp(
-    "((?<owner>[^/]+)/)?(?<repo>[^/@]+)(/(?<path>[^@]+))?(@(?<ref>.*))?"
+    "^((?<owner>[^/]+)/)?(?<repo>[^/@]+)(/(?<path>[^@]+))?(@(?<ref>.*))?$"
   );
-  const pieces = format.exec(configFile);
+  const pieces = format.exec(configFile.trim());
   if (!pieces?.groups?.repo || pieces.groups.repo.trim().length === 0) {
     throw new ConfigurationError(
       getConfigFileRepoFormatInvalidMessage(configFile)
diff --git a/src/config/remote-file.test.ts b/src/config/remote-file.test.ts
index a914fde0c..1d4ed1f72 100644
--- a/src/config/remote-file.test.ts
+++ b/src/config/remote-file.test.ts
@@ -31,6 +31,19 @@ test("parseRemoteFileAddress accepts full remote addresses", async (t) => {
       ref: "ref/feature",
     } satisfies RemoteFileAddress,
   );
+
+  t.deepEqual(
+    parseRemoteFileAddress(
+      env,
+      "  owner/repo/path/to/codeql.yml@ref/feature  ",
+    ),
+    {
+      owner: "owner",
+      repo: "repo",
+      path: "path/to/codeql.yml",
+      ref: "ref/feature",
+    } satisfies RemoteFileAddress,
+  );
 });
 
 test("parseRemoteFileAddress accepts remote address without an owner", async (t) => {
diff --git a/src/config/remote-file.ts b/src/config/remote-file.ts
index 9b8e37056..c2303417e 100644
--- a/src/config/remote-file.ts
+++ b/src/config/remote-file.ts
@@ -51,9 +51,9 @@ export function parseRemoteFileAddress(
 ): RemoteFileAddress {
   // retrieve the various parts of the config location, and ensure they're present
   const format = new RegExp(
-    "((?<owner>[^/]+)/)?(?<repo>[^/@]+)(/(?<path>[^@]+))?(@(?<ref>.*))?",
+    "^((?<owner>[^/]+)/)?(?<repo>[^/@]+)(/(?<path>[^@]+))?(@(?<ref>.*))?$",
   );
-  const pieces = format.exec(configFile);
+  const pieces = format.exec(configFile.trim());
 
   // Check that the regular expression matched and that we have at least the repo name.
   if (!pieces?.groups?.repo || pieces.groups.repo.trim().length === 0) {