Skip to content

fix: render maintenance issue bodies as data - #26

Merged
codeandsolder merged 1 commit into
mainfrom
automation/harden-maintenance-rendering
Sep 10, 2026
Merged

codeandsolder merged 1 commit into
mainfrom
automation/harden-maintenance-rendering

Conversation

@codeandsolder

Copy link
Copy Markdown
Owner

Make the passive maintenance queue structurally safe against shell interpretation of Markdown.

Changes:

  • add a tiny renderer that substitutes only explicit ${name} placeholders from the environment
  • switch all five generated issue-body templates to quoted heredocs passed through that renderer
  • remove the tactical per-backtick escaping now that literal Markdown is never evaluated by Bash

The branch validation exercised literal backticks, literal $(...), and injected multiline data containing both forms, and verified that none of it executed while the rendered text was preserved exactly.

Closes #25

@codeandsolder
codeandsolder force-pushed the automation/harden-maintenance-rendering branch from 3795ed8 to ae89160 Compare September 10, 2026 12:59
@codeandsolder
codeandsolder merged commit 0ca6d0f into main Sep 10, 2026
13 checks passed
@codeandsolder-git-wrangler
codeandsolder-git-wrangler Bot deleted the automation/harden-maintenance-rendering branch September 29, 2026 04:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

maintenance: render generated issue bodies without shell evaluation

1 participant