Skip to content

fix: use jq --arg to pass RULESET_NAME in check-required-status-checks.sh#95

Open
kitsuyui wants to merge 1 commit into
mainfrom
fix/audit-edge-cases-check-status-jq-literal-injection-001
Open

fix: use jq --arg to pass RULESET_NAME in check-required-status-checks.sh#95
kitsuyui wants to merge 1 commit into
mainfrom
fix/audit-edge-cases-check-status-jq-literal-injection-001

Conversation

@kitsuyui

Copy link
Copy Markdown
Member

Problem

In scripts/check-required-status-checks.sh, RULESET_NAME was directly shell-expanded into a jq filter string:

gh api ... | jq -r ".[] | select(.name == \"${RULESET_NAME}\")"

If the ruleset name contains " or \, the jq filter would be syntactically broken or behave incorrectly (jq literal injection).

Fix

Changed to pipe gh api output to jq -r --arg name "${RULESET_NAME}", using jq's --arg option to safely separate data from code:

gh api ... | jq -r --arg name "${RULESET_NAME}" '.[] | select(.name == $name)'

This is the same pattern applied to configure-branch-ruleset.sh in PR #85.

Verification

  • shellcheck: pass
  • shfmt: pass
  • actionlint: pass

Scope

Single-line change in scripts/check-required-status-checks.sh. Functionally equivalent for typical ruleset names; prevents corruption for names containing " or \.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant