Skip to content

fix(strategy): sandbox sed for regex fields - #43

Merged
noctuum merged 1 commit into
mainfrom
fix/sandbox-yaml-regex
Oct 16, 2026
Merged

noctuum merged 1 commit into
mainfrom
fix/sandbox-yaml-regex

Conversation

@noctuum

@noctuum noctuum commented Oct 16, 2026

Copy link
Copy Markdown
Member

A regex field of a package YAML was part of the program of sed. A tag_version_regex such as .*|touch pwned|e;s|(x)|y|;# closed the s command and added the GNU e flag, and sed ran touch while validate-pkg.sh checked the field. The same held in github-release, github-tag, github-nightly and for the pattern of webpage-scrape, so a pull request that changes only a package YAML ran code on the machine that validated it.

Every sed that takes such a field now runs with --sandbox, which refuses e, r and w. grep takes the field after -e, so a pattern that starts with a dash is a pattern and not an option.

bats tests/ --recursive: 429 pass.

@codecov

codecov Bot commented Oct 16, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@noctuum
noctuum merged commit b1ac4e0 into main Oct 16, 2026
5 checks passed
@noctuum
noctuum deleted the fix/sandbox-yaml-regex branch October 16, 2026 23:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant