mirror of
https://github.com/garrytan/gstack.git
synced 2026-05-05 13:15:24 +02:00
0502df6fdb
SKILL, OUTCOME, SESSION_ID, SOURCE, and EVENT_TYPE values go directly into printf %s for JSONL output. If any contain double quotes, backslashes, or newlines, the JSON breaks — or worse, injects arbitrary fields. Fix: strip quotes, backslashes, and control characters from all string fields before JSONL construction via json_safe() helper.