Skip to content

Sanitize pattern titles and categories#817

Merged
MaggieCabrera merged 3 commits intotrunkfrom
fix-sanitization
Mar 16, 2026
Merged

Sanitize pattern titles and categories#817
MaggieCabrera merged 3 commits intotrunkfrom
fix-sanitization

Conversation

@MaggieCabrera
Copy link
Contributor

@MaggieCabrera MaggieCabrera commented Mar 16, 2026

Sanitize pattern title and category values before writing them into PHP docblock headers in generated pattern files, preventing comment escape via */ sequences.

Screenshot 2026-03-16 at 11 47 26

@MaggieCabrera MaggieCabrera requested a review from mikachan March 16, 2026 08:54
@MaggieCabrera MaggieCabrera self-assigned this Mar 16, 2026
@MaggieCabrera MaggieCabrera changed the title Fix PHP comment injection in pattern file generation Sanitize pattern titles and categories Mar 16, 2026
Copy link
Member

@mikachan mikachan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is working well for me in testing. Here is an exported pattern title using */:

Image

🚢

@MaggieCabrera MaggieCabrera merged commit e04c89c into trunk Mar 16, 2026
13 checks passed
@MaggieCabrera MaggieCabrera deleted the fix-sanitization branch March 16, 2026 12:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants