From b80b05b9bcca7711d8ddfcf10ce0effd44699f99 Mon Sep 17 00:00:00 2001
From: Kemal Hadimli <disq@users.noreply.github.com>
Date: Fri, 4 Sep 2026 12:41:51 +0100
Subject: [PATCH] fix: Reject empty or malformed org/name in plugin version
 warner

---
 managedplugin/version_checker.go      |  5 +++++
 managedplugin/version_checker_test.go | 15 +++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/managedplugin/version_checker.go b/managedplugin/version_checker.go
index b6272393..e0e956ea 100644
--- a/managedplugin/version_checker.go
+++ b/managedplugin/version_checker.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/Masterminds/semver"
 	cloudquery_api "github.com/cloudquery/cloudquery-api-go"
@@ -31,6 +32,10 @@ func (p *PluginVersionWarner) getLatestVersion(ctx context.Context, org string,
 		p.logger.Debug().Str("plugin", name).Str("kind", kind).Msg("invalid kind")
 		return nil, fmt.Errorf("invalid kind: %s", kind)
 	}
+	if org == "" || name == "" || strings.ContainsRune(org, '/') || strings.ContainsRune(name, '/') {
+		p.logger.Debug().Str("org", org).Str("plugin", name).Msg("invalid org or plugin name")
+		return nil, fmt.Errorf("invalid plugin reference: %q/%q", org, name)
+	}
 	resp, err := p.hubClient.GetPluginWithResponse(ctx, org, cloudquery_api.PluginKind(kind), name)
 	if err != nil {
 		p.logger.Debug().Str("plugin", name).Err(err).Msg("failed to get plugin info from hub")
diff --git a/managedplugin/version_checker_test.go b/managedplugin/version_checker_test.go
index 3ed101aa..970b506c 100644
--- a/managedplugin/version_checker_test.go
+++ b/managedplugin/version_checker_test.go
@@ -17,6 +17,21 @@ func TestPluginVersionWarnerUnknownPluginFails(t *testing.T) {
 	assert.False(t, warned)
 }
 
+func TestPluginVersionWarnerInvalidOrgOrNameFails(t *testing.T) {
+	versionWarner, err := NewPluginVersionWarner(zerolog.Nop(), "")
+	require.NoError(t, err)
+	for _, tc := range []struct{ org, name string }{
+		{org: "", name: ".cq"},
+		{org: "cloudquery", name: ""},
+		{org: "", name: ""},
+		{org: "cloudquery/aws", name: "plugin"},
+	} {
+		warned, err := versionWarner.WarnIfOutdated(context.Background(), tc.org, tc.name, "source", "1.0.0")
+		assert.Error(t, err, "%q/%q", tc.org, tc.name)
+		assert.False(t, warned)
+	}
+}
+
 // Note: this is an integration test that requires Internet access and the hub to be running
 func TestPluginLatestVersionDoesNotWarn(t *testing.T) {
 	versionWarner, err := NewPluginVersionWarner(zerolog.Nop(), "")