mirror of
https://github.com/garrytan/gstack.git
synced 2026-08-25 23:42:32 +02:00
SKILL, OUTCOME, SESSION_ID, SOURCE, and EVENT_TYPE values go directly into printf %s for JSONL output. If any contain double quotes, backslashes, or newlines, the JSON breaks — or worse, injects arbitrary fields. Fix: strip quotes, backslashes, and control characters from all string fields before JSONL construction via json_safe() helper.