From 9073743b478a68449246852e3b53e3fe82be1747 Mon Sep 17 00:00:00 2001 From: anupamme Date: Fri, 31 Jul 2026 03:07:04 +0000 Subject: [PATCH] fix: sanitize child_process call in process-templates.js Detected calls to child_process from a function argument `branch` Addresses javascript.lang.security.detect-child-process.detect-child-process --- .github/scripts/process-templates.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/scripts/process-templates.js b/.github/scripts/process-templates.js index 97e9622..2b4e999 100644 --- a/.github/scripts/process-templates.js +++ b/.github/scripts/process-templates.js @@ -34,6 +34,11 @@ function getBranch(repoUrl) { // Function to get repository information (last commit date and stars) function getRepoInfo(repoPath, branch = 'main') { + // Validate branch name to prevent command injection via shell metacharacters + if (!/^[a-zA-Z0-9/_.\-]+$/.test(branch)) { + console.error(`Skipping repo info: invalid branch name "${branch}"`); + return { lastCommitDate: null, stars: 0, forks: 0 }; + } const info = { lastCommitDate: null, stars: 0,