CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-05-07 14:06:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: shell script injection in gstack-config and telemetry (MEDIUM-04)

Browse Source 
- gstack-config: validate keys (alphanumeric+underscore only)
- gstack-config: use grep -F (fixed string) instead of -E (regex)
- gstack-config: escape sed special chars in values, drop newlines
- gstack-telemetry-log: sanitize REPO_SLUG and BRANCH via json_safe()
This commit is contained in:
Garry Tan
2026-03-27 22:14:08 -07:00
parent 87d54689ba
commit 87d223f15a
2 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/gstack-telemetry-log
+2
View File
@@ -158,6 +158,8 @@ OUTCOME="$(json_safe "$OUTCOME")"
SESSION_ID="$(json_safe "$SESSION_ID")"
SOURCE="$(json_safe "$SOURCE")"
EVENT_TYPE="$(json_safe "$EVENT_TYPE")"
REPO_SLUG="$(json_safe "$REPO_SLUG")"
BRANCH="$(json_safe "$BRANCH")"
# Escape null fields — sanitize ERROR_CLASS and FAILED_STEP via json_safe()
ERR_FIELD="null"