[code-scanning-fix] Fix go/unsafe-quoting: Escape single quotes in JSON data #11382

github-actions · 2026-01-22T20:07:03Z

Security Fix: Unsafe Quoting in Project Views Configuration

Alert Number: #538
Severity: Critical
Rule: go/unsafe-quoting
CWE: CWE-78 (OS Command Injection), CWE-89 (SQL Injection), CWE-94 (Code Injection)

Vulnerability Description

The code was constructing a shell environment variable by embedding JSON data directly into a single-quoted string without proper escaping. If the JSON data contained a single quote character, it could break out of the enclosing quotes and potentially allow command injection.

Vulnerable Code (Line 47):

customEnvVars = append(customEnvVars, fmt.Sprintf("          GH_AW_PROJECT_VIEWS: '%s'\n", string(viewsJSON)))

If viewsJSON contains the character ', it would prematurely close the string literal and potentially execute arbitrary shell commands.

Location

File: pkg/workflow/update_project_job.go
Line: 47
Function: buildUpdateProjectJob

Fix Applied

Added proper shell escaping for single quotes before embedding the JSON data into the environment variable string. The fix uses POSIX-compatible shell escaping:

Escape backslashes first: \ → \\ (prevents interference with quote escaping)
Escape single quotes: ' → '\'' (ends the quoted string, adds escaped quote, starts new quoted string)

Changes Made:

Added strings import for string manipulation
Replaced backslashes with double backslashes to prevent escape sequence interference
Replaced single quotes with '\'' (POSIX shell escape sequence)
Applied escaping to viewsJSON before embedding in the format string

Secure Code (Lines 48-52):

// Escape single quotes in JSON to prevent shell injection
// Replace backslashes first, then single quotes
escapedJSON := strings.ReplaceAll(string(viewsJSON), `\`, `\\`)
escapedJSON = strings.ReplaceAll(escapedJSON, `'`, `'\''`)
customEnvVars = append(customEnvVars, fmt.Sprintf("          GH_AW_PROJECT_VIEWS: '%s'\n", escapedJSON))

Security Best Practices

This fix follows CodeQL's recommendations for handling potentially untrusted data:

Input Sanitization: Always escape special characters when embedding user-provided or dynamic data into shell commands
Defense in Depth: The escaping approach handles both backslashes and quotes to prevent complex injection attempts
POSIX Compliance: The '\'' technique works across all POSIX-compliant shells (bash, sh, zsh, etc.)
Preserve Functionality: The fix maintains the original behavior while preventing injection attacks

Testing Considerations

Unit Tests: Consider adding tests with JSON data containing single quotes, backslashes, and other special characters
Integration Tests: Test the workflow with project views that contain special characters in their configuration
Security Testing: Verify that malicious input cannot break out of the quoted string

Automated by: Code Scanning Fixer Workflow
Run ID: 21263052463

AI generated by Code Scanning Fixer

Changeset

Type: patch
Description: Escape single quotes and backslashes when embedding JSON into shell environment variables to prevent shell injection (fixes go/unsafe-quoting).

Ahoy! This treasure was crafted by 🏴‍☠️ Changeset Generator

- Add proper shell escaping for JSON data embedded in environment variables - Prevents potential command injection via single quotes in user data - Fixes CodeQL alert #538 (Critical severity) - Uses POSIX-compatible '\''escaping technique Security: Addresses CWE-78, CWE-89, CWE-94

pelikhan · 2026-01-22T21:18:34Z

pkg/workflow/update_project_job.go

 			return nil, fmt.Errorf("failed to marshal views configuration: %w", err)
 		}
-		customEnvVars = append(customEnvVars, fmt.Sprintf("          GH_AW_PROJECT_VIEWS: '%s'\n", string(viewsJSON)))
+		// Escape single quotes in JSON to prevent shell injection


@copilot we are writing a value in a yaml dictionary. The ' ' are not stricly needed. Encode viewsJSON using the YAML Marshal encoder insteead.

Copilot · 2026-01-22T21:18:54Z

@pelikhan I've opened a new pull request, #11386, to work on those changes. Once the pull request is ready, I'll request review from you.

* Initial plan * Use %q for JSON escaping in YAML dictionary values Replaced manual single-quote escaping with Go's %q format specifier, which: - Automatically handles all special characters and escaping - Produces cleaner YAML with double quotes instead of single quotes - Follows existing codebase patterns (e.g., add_comment.go) - Simplifies code by removing manual string replacement logic This addresses the feedback to use simpler escaping for JSON data in YAML dictionary values. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-01-22T22:40:11Z

@copilot recompile

Copilot · 2026-01-22T22:40:29Z

@pelikhan I've opened a new pull request, #11392, to work on those changes. Once the pull request is ready, I'll request review from you.

…ing (#11392) * Initial plan * Recompile workflows after security fix Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-01-22T22:55:24Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-01-22T22:55:25Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-01-22T22:55:26Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-01-22T22:55:36Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-22T22:58:56Z

Smoke Test Results

Last 2 Merged PRs:

Replace manual quote escaping with %q format specifier for YAML encoding #11392: Replace manual quote escaping with %q format specifier for YAML encoding
Replace manual quote escaping with %q format specifier #11386: Replace manual quote escaping with %q format specifier

Test Results:

✅ GitHub MCP
✅ Safe Inputs GH CLI
✅ Serena MCP
✅ Playwright
✅ File Writing
✅ Bash Tool

Overall Status: PASS

cc @pelikhan

AI generated by Smoke Copilot

github-actions · 2026-01-22T22:59:11Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-22T22:59:14Z

GitHub MCP (last 2 merged PRs): ✅ Replace manual quote escaping with %q format specifier for YAML encoding; Replace manual quote escaping with %q format specifier
safeinputs-gh pr list: ✅
Serena activate_project: ✅
Playwright github.com title contains "GitHub": ✅
Tavily search results: ✅
File write (/tmp/gh-aw/agent/smoke-test-codex-21267824404.txt): ✅
Bash cat verify: ✅
Overall status: PASS

AI generated by Smoke Codex

github-actions · 2026-01-22T23:00:02Z

Smoke Test: PASS

Retrieved PRs:

Update dev workflow to build and test project #11393: Update development workflow instructions for project build and test
[code-scanning-fix] Fix go/unsafe-quoting: Escape single quotes in JSON data #11382: Fix go/unsafe-quoting: Escape single quotes in JSON data

Overall Status: PASS

AI generated by Smoke Claude

…2-00bd24b6b438b87e

github-actions bot added critical security labels Jan 22, 2026

mnkiefer added agentic-campaign z_campaign_security-alert-burndown and removed agentic-campaign z_campaign_security-alert-burndown labels Jan 22, 2026

Copilot AI mentioned this pull request Jan 22, 2026

Add campaign labels to worker workflows for discovery #11384

Merged

pelikhan reviewed Jan 22, 2026

View reviewed changes

Copilot AI mentioned this pull request Jan 22, 2026

Replace manual quote escaping with %q format specifier #11386

Merged

Copilot AI mentioned this pull request Jan 22, 2026

Replace manual quote escaping with %q format specifier for YAML encoding #11392

Merged

pelikhan added the smoke label Jan 22, 2026

github-actions bot added the smoke-copilot label Jan 22, 2026

github-actions bot mentioned this pull request Jan 22, 2026

Smoke Test: Copilot - 21267824377 #11394

Closed

github-actions bot added the smoke-codex label Jan 22, 2026

Add changeset [skip-ci]

a47130e

This was referenced Jan 22, 2026

Smoke Test: Copilot - 21267837655 #11396

Closed

Add discussion commenting to smoke workflows with explicit instructions, deprecate discussion flag #11360

Merged

github-actions bot mentioned this pull request Jan 22, 2026

Smoke Test: Claude - 21267824386 #11397

Closed

github-actions bot added the smoke-claude label Jan 22, 2026

pelikhan marked this pull request as ready for review January 22, 2026 23:00

Merge branch 'main' into fix/code-scanning-alert-538-unsafe-quoting-v…

d8afa50

…2-00bd24b6b438b87e

pelikhan enabled auto-merge (squash) January 22, 2026 23:00

github-actions bot mentioned this pull request Jan 22, 2026

Smoke Test: Claude - 21267837646 #11399

Closed

pelikhan merged commit 1b5ed9b into main Jan 22, 2026
48 checks passed

pelikhan deleted the fix/code-scanning-alert-538-unsafe-quoting-v2-00bd24b6b438b87e branch January 22, 2026 23:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[code-scanning-fix] Fix go/unsafe-quoting: Escape single quotes in JSON data #11382

[code-scanning-fix] Fix go/unsafe-quoting: Escape single quotes in JSON data #11382

github-actions bot commented Jan 22, 2026 •

edited by agentic-workflows-dev bot

Loading

Uh oh!

pelikhan Jan 22, 2026

Uh oh!

Copilot AI commented Jan 22, 2026

Uh oh!

pelikhan commented Jan 22, 2026

Uh oh!

Copilot AI commented Jan 22, 2026

Uh oh!

github-actions bot commented Jan 22, 2026

Uh oh!

github-actions bot commented Jan 22, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 22, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 22, 2026 •

edited by agentic-workflows-dev bot

Loading

Uh oh!

github-actions bot commented Jan 22, 2026

Uh oh!

github-actions bot commented Jan 22, 2026

Uh oh!

github-actions bot commented Jan 22, 2026

Uh oh!

github-actions bot commented Jan 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

[code-scanning-fix] Fix go/unsafe-quoting: Escape single quotes in JSON data #11382

[code-scanning-fix] Fix go/unsafe-quoting: Escape single quotes in JSON data #11382

Conversation

github-actions bot commented Jan 22, 2026 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security Fix: Unsafe Quoting in Project Views Configuration

Vulnerability Description

Location

Fix Applied

Changes Made:

Security Best Practices

Testing Considerations

Changeset

Uh oh!

pelikhan Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jan 22, 2026

Uh oh!

pelikhan commented Jan 22, 2026

Uh oh!

Copilot AI commented Jan 22, 2026

Uh oh!

github-actions bot commented Jan 22, 2026

Uh oh!

github-actions bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 22, 2026 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 22, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Jan 22, 2026

Uh oh!

github-actions bot commented Jan 22, 2026

Uh oh!

github-actions bot commented Jan 22, 2026

Smoke Test: PASS

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Jan 22, 2026 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Jan 22, 2026 •

edited

Loading

github-actions bot commented Jan 22, 2026 •

edited

Loading

github-actions bot commented Jan 22, 2026 •

edited by agentic-workflows-dev bot

Loading