From fd01e441d579884c8fd21c73f17dfabcf4841c1e Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Thu, 10 Sep 2026 14:14:57 -0400
Subject: [PATCH] fix(ci): update pull request generator

---
 scripts/create_pull_request.rb | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/scripts/create_pull_request.rb b/scripts/create_pull_request.rb
index e4f00531c51..6374a76a8da 100644
--- a/scripts/create_pull_request.rb
+++ b/scripts/create_pull_request.rb
@@ -52,14 +52,29 @@
 COMMIT_COMMENT=@options[:commit_comment]
 
 def generate_pr_for_target_changes(repo_root:, target_path:)
-  abs_target_path = File.expand_path(target_path)
-  Dir.chdir(repo_root) do
-    if system('git', 'diff', '--quiet', abs_target_path)
+  raise ArgumentError, "Repository root '#{repo_root}' does not exist or is not a directory." unless File.directory?(repo_root)
+
+  real_repo_root = File.realpath(repo_root)
+  abs_target_path = File.expand_path(target_path, real_repo_root)
+  raise ArgumentError, "Target path '#{target_path}' does not exist." unless File.exist?(abs_target_path)
+
+  real_target_path = File.realpath(abs_target_path)
+  repo_prefix = real_repo_root.end_with?(File::SEPARATOR) ? real_repo_root : real_repo_root + File::SEPARATOR
+  unless real_target_path == real_repo_root || real_target_path.start_with?(repo_prefix)
+    raise ArgumentError, "Target path '#{target_path}' must be within repository root."
+  end
+
+  unless BASE_BRANCH =~ /\A[a-zA-Z0-9_\.\/-]+\z/ && !BASE_BRANCH.start_with?('-')
+    raise ArgumentError, "Invalid base branch name '#{BASE_BRANCH}'."
+  end
+
+  Dir.chdir(real_repo_root) do
+    if system('git', 'diff', '--quiet', '--', real_target_path)
       puts "The file, #{target_path}, has no changes."
       return
     end
     system('git', 'checkout', '-B', BASE_BRANCH) || raise("git checkout failed")
-    system('git', 'add', abs_target_path) || raise("git add failed")
+    system('git', 'add', '--', real_target_path) || raise("git add failed")
     system('git', 'commit', '-m', COMMIT_COMMENT) || raise("git commit failed")
     system('git', 'push', '-u', 'origin', BASE_BRANCH) || raise("git push failed")
   end