analyze: widen unescaped-${VAR} detector to scan the whole raw pipeline file #14
Reference in New Issue
Block a user
Delete Branch "fix/unescaped-var-whole-file-scan"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Fixes oleks/pipetree#13
Adds a whole-raw-file scanning pass (
findUnescapedVarsInFile) alongside the existing per-command scan for theUnescapedWoodpeckerVarfootgun detector, so literal unescaped${VAR}in step names/comments/environment values (outside anycommands:string) are now caught too. Results are deduped against the existing per-command pass.Includes a new test fixture (
testdata/deals-comment-above-commands.yaml) reproducing the actual incident from the issue.findUnescapedVars only walked parsed Commands strings, so a literal ${VAR} in a step name, top-level comment, or environment: value - all outside any commands: string - passed the check clean while Woodpecker's own ${VAR} substitution pass (which runs over the entire raw pipeline YAML text, not just command bodies) hard-failed the pipeline at compile time. Add findUnescapedVarsInFile as a whole-file pass alongside the existing per-command scan, deduped against it so nothing inside a commands: string gets reported twice. Fixes oleks/pipetree#13, reproduced by a fixture matching the actual incident: an explanatory comment above a step's commands: block containing unescaped ${VAR} example text (oleks/deals pipelines #12/#13, oleks/element-web-patched #5/#6).