didericis/bot-bottle
1
0
Fork 0
Code Issues 7 Pull Requests 15 Actions Packages Projects Releases Wiki Activity

Harden git_gate.py shell rendering #166

Merged
didericis merged 1 commits from fix/shell-injection-git-gate into main 2026-06-03 00:47:34 -04:00
Conversation 1 Commits 1 Files Changed 4
+104 -11

1 Commits

Author SHA1 Message Date
didericis-claude cc0c952d0b fix(security): harden git_gate.py shell rendering with shlex.quote and name validation
test / unit (pull_request) Successful in 35s
Details
test / integration (pull_request) Successful in 44s
Details
test / unit (push) Successful in 32s
Details
test / integration (push) Successful in 41s
Details 
Use shlex.quote() on name and upstream_url in git_gate_render_entrypoint()
so special characters (single quotes, spaces, semicolons) cannot break or
inject into the generated sh script.

Add _GIT_NAME_RE validation in GitEntry.from_repos_entry() to restrict
repo names to [A-Za-z0-9._-]+, making the manifest the first line of
defence and shlex.quote() the belt-and-suspenders backstop.

Closes #155
 2026-06-03 04:40:21 +00:00