mirror of
https://github.com/garrytan/gstack.git
synced 2026-05-06 05:35:46 +02:00
Arun Kumar Thiagarajan
8876893c59
gstack-review-log appends its argument directly to a JSONL file with no validation. Malformed or crafted input could corrupt the review log or inject arbitrary content. Fix: validate input is parseable JSON via python3 before appending. Reject with exit 1 and stderr message if invalid.
19 lines
714 B
Bash
Executable File
19 lines
714 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# gstack-review-log — atomically log a review result
|
|
# Usage: gstack-review-log '{"skill":"...","timestamp":"...","status":"..."}'
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
eval "$("$SCRIPT_DIR/gstack-slug" 2>/dev/null)"
|
|
GSTACK_HOME="${GSTACK_HOME:-$HOME/.gstack}"
|
|
mkdir -p "$GSTACK_HOME/projects/$SLUG"
|
|
|
|
# Validate: input must be parseable JSON (reject malformed or injection attempts)
|
|
INPUT="$1"
|
|
if ! printf '%s' "$INPUT" | python3 -c "import json,sys; json.load(sys.stdin)" 2>/dev/null; then
|
|
# Not valid JSON — refuse to append
|
|
echo "gstack-review-log: invalid JSON, skipping" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "$INPUT" >> "$GSTACK_HOME/projects/$SLUG/$BRANCH-reviews.jsonl"
|