fix(webhook): handle special characters in issue title and body - #15
Merged
Merged
Conversation
The curl command used single-quoted strings to construct the JSON
payload. When issue titles or bodies contained single quotes (e.g.
"It's a bug"), the shell quoting broke, causing the webhook to fail
silently.
Replace manual JSON construction with jq --arg for safe string handling.
Also restrict envsubst to only expand known template variables, and
strip ${ patterns in SanitizeShellValue for defense in depth.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
curl -d '...'单引号包裹 JSON payload，当 issue 标题或正文包含单引号（如It's a bug）时，shell 引号配对被打破，导致 webhook 发送失败jq --arg+ 环境变量安全构造 JSON payload，彻底避免 shell 引号问题envsubst只扩展模板中已知的变量名，防止${VAR}意外扩展SanitizeShellValue中增加${模式剥离，纵深防御Changes
.github/workflows/issue-webhook.ymljq -n --arg替代手动 JSON 构建.github/workflows/pr-review-webhook.ymlinternal/docker/runner.goSanitizeShellValue增加${剥离runner-image/entrypoint.shenvsubst指定明确的变量列表Test plan
go vet ./...通过go build ./...通过go test ./...通过golangci-lint run通过It's a bug (urgent) $100 [claude bot]）验证 webhook 正常触发🤖 Generated with Claude Code