Skip to content

YAML generation uses manual string building in compile_gate_step_external #384

@jamesadevine

Description

@jamesadevine

src/compile/filter_ir.rs:

step.push_str(&format!(" name: {}\n", ctx.step_name()));
step.push_str(&format!(" displayName: "{}"\n", ctx.display_name()));
These values come from &'static str constants so there's no injection risk today. But the pattern is fragile — a future GateContext variant with a display name containing " or \n would silently produce invalid YAML. Suggest serializing via serde_yaml or at minimum YAML-escaping display names.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions