Merge branch 'main' into bolt/performance-optimizations-15425688384079757854

Signed-off-by: Amr Abed <3361565+amrabed@users.noreply.github.com>

Author: amrabed

pyproject.toml

@@ -17,8 +17,8 @@ rename = "scripts.rename:main"
 [dependency-groups]
 dev = [
     "pytest>=9.0.1",
-    "ruff>=0.15.12",
-    "coverage>=7.6.9",
+    "ruff>=0.15.13",
+    "coverage>=7.14.0",
     "pre-commit>=4.0.1",
     "pyright>=1.1.391",
 ]
@@ -36,7 +36,7 @@ build-backend = "hatchling.build"
 line-length = 120
 
 [tool.ruff.lint]
-select = ["E", "I"]
+select = ["E", "I", "S"]
 
 [tool.coverage.run]
 branch = true

scripts/rename.py

@@ -14,12 +14,27 @@
 @option("--email", required=True, help="Author email")
 @option("--github", required=True, help="GitHub username")
 def main(name: str, description: str, author: str, email: str, github: str):
-    # Validate name to prevent directory traversal or other injection
+    # Validate inputs to prevent configuration injection
+    for label, value in [
+        ("name", name),
+        ("description", description),
+        ("author", author),
+        ("email", email),
+        ("github", github),
+    ]:
+        if "\n" in value or "\r" in value:
+            raise UsageError(f"Invalid {label}: newlines are not allowed.")
+        if label != "description" and '"' in value:
+            raise UsageError(f"Invalid {label}: double quotes are not allowed.")
+
     if not re.match(r"^[a-zA-Z0-9_-]+$", name):
         raise UsageError(
             f"Invalid project name '{name}'. Only alphanumeric characters, dashes, and underscores are allowed."
         )
 
+    # Sanitize description for TOML double-quoted strings
+    description = description.replace('"', '\\"')
+
     source = name.replace("-", "_").lower()
 
     echo(f"Initializing project '{name}' (source: '{source}')...")
@@ -59,7 +74,7 @@ def main(name: str, description: str, author: str, email: str, github: str):
         content = path.read_text()
         new_content = content
         for pattern, replacement in patterns:
-            new_content = re.sub(pattern, replacement, new_content, flags=re.MULTILINE)
+          new_content = re.sub(pattern, lambda _: replacement, content, flags=re.MULTILINE)
 
         if new_content != content:
             path.write_text(new_content)