mosaicstack/stack
1
0
Fork 0
Code Issues 23 Pull Requests 3 Actions Packages Projects Releases 14 Wiki Activity

fix(framework/tools): eval injection, broken JSON, and tmpfile leak in git wrappers #548

New Issue
Closed
opened 2026-06-18 18:51:03 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-06-18 18:51:03 +00:00
Owner
Copy Link

Three confirmed defects in packages/mosaic/framework/tools/git/:

F-01 (HIGH, shell injection) — issue-edit.sh and issue-assign.sh build commands via string interpolation then run eval. A title/body/label containing $(id) will execute arbitrary code.

F-07 (MED, broken JSON) — milestone-create.sh builds GitHub API JSON payload via string interpolation. A title containing a double-quote breaks the JSON, causing the API call to fail.

F-13 (LOW, tmpfile leak) — pr-metadata.sh creates a tmpfile via mktemp inside curl_gitea_pull() but only removes it in the success paths. A set -e early exit leaks the file.

Fix branch: fix/tooling-eval-injection-jq-json

Three confirmed defects in packages/mosaic/framework/tools/git/: **F-01 (HIGH, shell injection)** — issue-edit.sh and issue-assign.sh build commands via string interpolation then run eval. A title/body/label containing $(id) will execute arbitrary code. **F-07 (MED, broken JSON)** — milestone-create.sh builds GitHub API JSON payload via string interpolation. A title containing a double-quote breaks the JSON, causing the API call to fail. **F-13 (LOW, tmpfile leak)** — pr-metadata.sh creates a tmpfile via mktemp inside curl_gitea_pull() but only removes it in the success paths. A set -e early exit leaks the file. Fix branch: fix/tooling-eval-injection-jq-json
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#548
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?