escape or sanitize inputs

[drrobotnik]

Fields to and from Jira can have any type of formatting. These fields should be escaped before being placed in the YAML templates.

For example:

fields:
  assignee:
    name: user
  description: As a visitor, I want clear information about XYZ^M
^M
Design updates located in assets^M
^M
*Notes:*^M
* XXXXXXXXXXX^M
* XXXXXXX ^M
* XXXXXXXXXX ^M
^M
_*Acceptance Criteria*_^M
1. XXXXXXXX^M

  customfield_13624: "."
transition:
  id: 21
  name: In Progress

Results in:

ERROR yaml: line 7: could not find expected ':'
? Invalid YAML syntax, edit again? (Y/n) 

In this case the description should be wrapped in parenthesis and if the story includes any special characters they should be escaped. Having to do this manually is cumbersome.

This is also true for custom commands and arguments.

For example:

  - name: release
    help: display stories related to a release
    script: |-
       {{jira}} list --template=list-stories --query "project = $JIRA_PROJECT AND status in (resolved, closed) and {{args.fixversion}}"
    args:
      - name: fixversion
        required: false

$ jira release fixversion="2016.52.00 10.17.2017"

Invalid Usage: Error in the JQL Query: Expecting either 'OR' or 'AND' but got '10.17.2017'. (line 1, character 77)

[coryb]

The transition template is bad for the description field. This is the current template section:

{{if .meta.fields.description}}
  description: {{or .overrides.description .fields.description }}
{{- end -}}

It needs to use the multiline block yaml notation like:

{{if .meta.fields.description}}
  description: |~
    {{ or .fields.description "" | indent 4 }}
{{- end -}}

I will get this change in.

For the JQL issue, that is hard to do the escaping generically. I would argue that it is a problem with your query string rather than an issue with jira.

I would rewrite you command like:

- name: release
    help: display stories related to a release
    script: |-
       {{jira}} list --template=list-stories --query "project = $JIRA_PROJECT AND status in (resolved, closed) {{if options.fixversion}}and fixversion=\"{{options.fixversion}}\"{{end}}"
    options:
      - name: fixversion

then the usage would be jira release or jira release --fixversion="2016.52.00 10.17.2017"

[drrobotnik]

Great.

I like the solution for the custom command options.

Thanks!

[coryb]

I have updated the default template and cut a release:
https://github.com/Netflix-Skunkworks/go-jira/releases/tag/v1.0.11

Hopefully that fixes your escaping issues with the description field.