actions/paths-filter
1
0
Fork 0
mirror of https://github.com/dorny/paths-filter.git synced 2026-08-31 04:07:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: escape multi-line filenames in list-files shell and csv output

Browse Source 
Fixes GHSA-7hc6-8hq5-9q2m
This commit is contained in:
Ken Matsui
2026-07-30 23:48:19 -04:00
parent b41dfa943b
commit 93c889f9e5
5 changed files with 26 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/index.js
Vendored
+3 -3
View File
@@ -501,7 +501,7 @@ function csvEscape(value) {
if (value === '')
return value;
// Only safe characters
if (/^[a-zA-Z0-9._+:@%/-]+$/m.test(value)) {
if (/^[a-zA-Z0-9._+:@%/-]+$/.test(value)) {
return value;
}
// https://tools.ietf.org/html/rfc4180
@@ -533,12 +533,12 @@ function shellEscape(value) {
if (value === '')
return value;
// Only safe characters
if (/^[a-zA-Z0-9,._+:@%/-]+$/m.test(value)) {
if (/^[a-zA-Z0-9,._+:@%/-]+$/.test(value)) {
return value;
}
if (value.includes("'")) {
// Only safe characters, single quotes and white-spaces
if (/^[a-zA-Z0-9,._+:@%/'\s-]+$/m.test(value)) {
if (/^[a-zA-Z0-9,._+:@%/'\s-]+$/.test(value)) {
return `"${value}"`;
}
// Split by single quote and apply escaping recursively