harald/zeroclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 3

fix(imessage): escape newlines in AppleScript string interpolation

Browse source 
Prevents code injection via line breaks by escaping newline and carriage return characters in AppleScript string interpolation.
This commit is contained in:
Argenis 2026-02-15 08:00:59 -05:00 • committed by GitHub
parent e89415fc9a
commit e3791aebcb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/channels/imessage.rs
View file

@ -36,8 +36,12 @@ impl IMessageChannel {
/// This prevents injection attacks by escaping:
/// - Backslashes (`\` → `\\`)
/// - Double quotes (`"` → `\"`)
/// - Newlines (`\n` → `\\n`, `\r` → `\\r`) to prevent code injection via line breaks
fn escape_applescript(s: &str) -> String {
s.replace('\\', "\\\\").replace('"', "\\\"")
s.replace('\\', "\\\\")
.replace('"', "\\\"")
.replace('\n', "\\n")
.replace('\r', "\\r")
}
/// Validate that a target looks like a valid phone number or email address.
@ -386,8 +390,10 @@ mod tests {
}
#[test]
fn escape_applescript_newlines_preserved() {
assert_eq!(escape_applescript("line1\nline2"), "line1\nline2");
fn escape_applescript_newlines_escaped() {
assert_eq!(escape_applescript("line1\nline2"), "line1\\nline2");
assert_eq!(escape_applescript("line1\rline2"), "line1\\rline2");
assert_eq!(escape_applescript("line1\r\nline2"), "line1\\r\\nline2");
}
// ══════════════════════════════════════════════════════════