INNER CODE UNIT · TypeScript

neutralizeLogString

EndBug/add-and-commit · src/util.ts:73

export function neutralizeLogString(s: string): string {
  return s.replace(LOG_UNSAFE_CHARS, ch => {
    const hex = ch.codePointAt(0)!.toString(16).padStart(4, '0');
    return `\\u${hex}`;
  });
}

/**
 * `core.info` writes straight to stdout with no escaping, so the Actions
 * runner would treat a newline followed by `::command::` as a workflow
 * command. Neutralize first so user-controlled strings cannot inject that.
 */
export function safeInfo(message: string): void {
  // Direct core.info is forbidden elsewhere (no-restricted-syntax).
  // eslint-disable-next-line no-restricted-syntax
  core.info(neutralizeLogString(message));
}

View source record →