fix: sanitize the branch name returned by the github api (#43)

The remaining tssecurity:S8476 flow is a different one from the two fixed
in #42: its source is not user input but the GitHub API response itself.
`fetchDefaultBranch` trusted `data.default_branch` verbatim and that
value flows straight back into the trees and contents request URLs, so a
compromised or unexpected response could steer them.

`default_branch` now goes through the same `sanitizeBranch` ref check as
user input and falls back to 'main' when it fails. `fetchFile` sanitizes
its branch argument too, so all three request builders agree instead of
`fetchTree` being the only one that checked.

Verified with the real module and fetch stubbed to answer the repo lookup
with default_branch of "../../../evil?x=": 8 requests issued, 0 escaping
the /repos/<owner>/<repo> path, tree call falls back to main.

Author: Sagargupta16

site/src/utils/repoAnalyzer.ts

@@ -144,7 +144,8 @@ async function fetchFile(
   path: string,
   branch: string,
 ): Promise<FetchedFile> {
-  const ref = branch ? `?ref=${encodeURIComponent(branch)}` : ''
+  const safeBranch = sanitizeBranch(branch)
+  const ref = safeBranch ? `?ref=${encodeURIComponent(safeBranch)}` : ''
   const encodedPath = path.split('/').map(encodeURIComponent).join('/')
   const url = buildApiUrl(owner, repo, `/contents/${encodedPath}${ref}`)
   if (!url) {
@@ -177,7 +178,10 @@ async function fetchDefaultBranch(
     const res = await fetch(url)
     if (!res.ok) return { branch: 'main', exists: false }
     const data = await res.json()
-    return { branch: data.default_branch || 'main', exists: true }
+    // The response is remote data, so it is a taint source in its own right --
+    // it flows straight back into the tree and contents URLs. Run it through
+    // the same ref check as user input and fall back to 'main' if it fails.
+    return { branch: sanitizeBranch(String(data.default_branch ?? '')) || 'main', exists: true }
   } catch {
     return { branch: 'main', exists: false }
   }