Skip to content

fix(cli): quote YAML frontmatter scalar values#132

Merged
chaliy merged 1 commit into
mainfrom
2026-05-18-fix-unescaped-yaml-frontmatter-vulnerability
May 18, 2026
Merged

fix(cli): quote YAML frontmatter scalar values#132
chaliy merged 1 commit into
mainfrom
2026-05-18-fix-unescaped-yaml-frontmatter-vulnerability

Conversation

@chaliy
Copy link
Copy Markdown
Contributor

@chaliy chaliy commented May 18, 2026

Motivation

  • Prevent frontmatter injection and parsing corruption by ensuring untrusted strings emitted in the markdown YAML frontmatter (request URL and response metadata) are safely quoted and escaped instead of concatenated raw.

Description

  • Added a small yaml_quote helper that uses JSON string escaping to safely quote scalar values and returns a valid YAML string representation.
  • Applied yaml_quote to the url, source_content_type, last_modified, and filename fields in the CLI formatter in crates/fetchkit-cli/src/main.rs and the MCP formatter in crates/fetchkit-cli/src/mcp.rs.
  • Updated unit tests in crates/fetchkit-cli/src/main.rs to expect quoted scalars and added a regression test that verifies newline and YAML-special payloads remain quoted and do not inject frontmatter keys.
  • Changes are minimal and preserve existing markdown-first output while hardening frontmatter integrity.

Testing

  • Ran formatter: cargo fmt --all which completed successfully.
  • Ran unit and integration tests for the CLI: cargo test -p fetchkit-cli and all tests passed (including the new regression test) with no failures.

Codex Task

@chaliy chaliy force-pushed the 2026-05-18-fix-unescaped-yaml-frontmatter-vulnerability branch from deb0360 to a4a6ea5 Compare May 18, 2026 04:43
@chaliy chaliy force-pushed the 2026-05-18-fix-unescaped-yaml-frontmatter-vulnerability branch from a4a6ea5 to b552a48 Compare May 18, 2026 04:45
@chaliy chaliy requested a review from Copilot May 18, 2026 04:47
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens markdown YAML frontmatter generation in the CLI and MCP formatter by quoting untrusted scalar metadata before emitting it.

Changes:

  • Added yaml_quote helpers using JSON string escaping.
  • Applied quoting to URL, content type, last modified, and filename frontmatter fields.
  • Updated CLI tests and added a regression test for newline/YAML-special scalar injection.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File Description
crates/fetchkit-cli/src/main.rs Quotes frontmatter scalar metadata and updates unit coverage.
crates/fetchkit-cli/src/mcp.rs Applies the same scalar quoting to MCP markdown output.
crates/fetchkit-cli/tests/cli_integration.rs Updates expected CLI markdown output for quoted URLs.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@chaliy chaliy merged commit 6a69f99 into main May 18, 2026
15 checks passed
@chaliy chaliy deleted the 2026-05-18-fix-unescaped-yaml-frontmatter-vulnerability branch May 18, 2026 05:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants