fix(git-tools): remove eval from issue-create wrapper #559

New Issue

jason.woltje · 2026-06-19T21:51:03Z

jason.woltje commented

2026-06-19 21:51:03 +00:00

Problem

The Mosaic git wrapper issue-create.sh builds a tea command string and executes it via eval. When an issue body contains Markdown inline code or shell-looking snippets, the shell can perform command substitution during the tea attempt.

Observed while creating issue #558: inline-code examples such as confidence/source values and mosaic budget command examples produced command-not-found / unknown-command noise before the API fallback succeeded.

Risk

User-provided issue/PR Markdown can be interpreted by the shell before reaching tea.
The API fallback may still create the issue, masking the unsafe wrapper behavior.
This is a security and reliability bug in the wrapper layer.

Required fix

Remove eval-based command construction from issue-create.sh.
Use argv arrays for gh and tea invocations.
Preserve multi-line Markdown bodies verbatim.
Add a regression test with Markdown containing inline-code, dollar signs, quotes, and command-looking snippets.

Acceptance criteria

Creating an issue with multi-line Markdown and inline code emits no shell command-substitution noise.
The issue body is preserved exactly enough for Markdown review.
Fallback behavior remains intact when tea cannot infer the repo.

## Problem The Mosaic git wrapper issue-create.sh builds a tea command string and executes it via eval. When an issue body contains Markdown inline code or shell-looking snippets, the shell can perform command substitution during the tea attempt. Observed while creating issue #558: inline-code examples such as confidence/source values and mosaic budget command examples produced command-not-found / unknown-command noise before the API fallback succeeded. ## Risk - User-provided issue/PR Markdown can be interpreted by the shell before reaching tea. - The API fallback may still create the issue, masking the unsafe wrapper behavior. - This is a security and reliability bug in the wrapper layer. ## Required fix - Remove eval-based command construction from issue-create.sh. - Use argv arrays for gh and tea invocations. - Preserve multi-line Markdown bodies verbatim. - Add a regression test with Markdown containing inline-code, dollar signs, quotes, and command-looking snippets. ## Acceptance criteria - Creating an issue with multi-line Markdown and inline code emits no shell command-substitution noise. - The issue body is preserved exactly enough for Markdown review. - Fallback behavior remains intact when tea cannot infer the repo.

jason.woltje referenced this issue

2026-06-20 09:26:09 +00:00

fix(git-tools): auto-detect Gitea --login from repo origin host (USC repos fail with default mosaicstack login) #560

jason.woltje referenced this issue from a commit

2026-06-20 09:52:18 +00:00

fix(framework/tools): wrapper body-safety + login-resolution hardening (#559, #560)

jason.woltje referenced a pull request that will close this issue

2026-06-20 09:53:03 +00:00

fix(framework/tools): wrapper hardening — TLS validation, cred-path fallback, no-CI fast-exit #551

jason.woltje closed this issue

2026-06-20 10:16:40 +00:00

Sign in to join this conversation.