Skip to content

Commit

Permalink
Remove double checking
Browse files Browse the repository at this point in the history
  • Loading branch information
benibenj committed May 2, 2024
1 parent f6eb247 commit dd558a9
Showing 1 changed file with 2 additions and 13 deletions.
15 changes: 2 additions & 13 deletions src/package.ts
Original file line number Diff line number Diff line change
Expand Up @@ -423,28 +423,17 @@ function sanitizeCommitMessage(message?: string): string | undefined {
}

// Check for characters that might escape quotes or introduce shell commands.
// Don't allow: ', ", `, $, \ (except for \n)
// Don't allow: ', ", `, $, \ (except for \n which is allowed)
const unsafeRegex = /(?<!\\)\\(?!n)|['"`$]/g;

// Remove any unsafe characters found by the unsafeRegex
const sanitizedMessage = message.replace(unsafeRegex, '');

// Additional check to make sure nothing potentially dangerous is still in the string
if ([`'`, `"`, '`', '$'].some(char => sanitizedMessage.includes(char))) {
throw new Error('Commit message contains potentially dangerous characters after initial sanitization.');
}

for (let index = 0; index < sanitizedMessage.length; index++) {
const char = sanitizedMessage[index];
if (char === '\\' && sanitizedMessage[index + 1] !== 'n') {
throw new Error('Commit message contains potentially dangerous characters after initial sanitization.');
}
}

if (sanitizedMessage.length === 0) {
return undefined;
}

// Add quotes as commit message is passed as a single argument to the shell
return `"${sanitizedMessage}"`;
}

Expand Down

0 comments on commit dd558a9

Please sign in to comment.