mirror of
https://github.com/renovatebot/renovate.git
synced 2026-11-03 02:53:40 +00:00
Jamie Tanna
e510b9a64d
To avoid the risk of shell injection being introduced into future `exec` calls, we can add a linter to scan for common variable inputs that may be malicious. The fields to look for come from the generated `templatableFields`, so we track the config options a repository can influence rather than restating them, with credentials and manager-specific fields - which no shared list covers - carried alongside. Booleans and numbers are dropped, as they can't carry shell metacharacters. A value is treated as escaped only when it actually is: `quote()`, `shlex.quote()`, shlex's `join()`, or `.map(quote).join()`. A bare `.join()` isn't, as `Array.prototype.join` escapes nothing, and we look through calls like `String(depName)` so wrapping a value doesn't hide it. Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>