App names with double quotes (") not escaped in yabai queries

[wxwern]

I've recently stumbled across an app with an app name containing double quotes, which caused yabai -m query --windows --window to output invalid json. From the source code here, it appears while app window titles are escaped, app names are not.

This has consequences like being able to inject arbitrary data into queries, though I don't think there's much harm that can be done just from that alone.

[koekeishiya]

Do you have a sample? The app name is pulled from what is shown in Activity Monitor and I didn't think those could contain quotes and such.

[wxwern]

This is a fresh macOS app created in Xcode.

This can be reproduced by just setting the Display Name of a macOS app (or CFBundleDisplayName key in Info.plist) to "Hello World", or any other text that includes the double quotes.

Since there's no sanitisation, yabai will thus return:

{
	...
	"app":""Hello World"",
	...
}