Skip to content

[Issue]: Apply CI output escaping to linting scripts #364

@WilliamBerryiii

Description

@WilliamBerryiii

Issue Description

Apply ConvertTo-GitHubActionsEscaped from CIHelpers module to all linting scripts that emit workflow commands. This prevents workflow command injection when user-controlled data (file paths, error messages) appears in CI output.

Files to update:

  • scripts/linting/Invoke-LinkLanguageCheck.ps1
  • scripts/linting/Invoke-PSScriptAnalyzer.ps1
  • scripts/linting/Invoke-YamlLint.ps1
  • scripts/linting/Link-Lang-Check.ps1
  • scripts/linting/Markdown-Link-Check.ps1
  • scripts/linting/Validate-MarkdownFrontmatter.ps1
  • scripts/linting/Modules/LintingHelpers.psm1

Additional Context

Related to PR #354 which introduced the CIHelpers module with escape functions. The escaping approach follows GitHub's official actions/toolkit implementation with additional defense-in-depth for :: sequences.

Metadata

Metadata

Labels

needs-triageRequires triage and prioritization

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions