2026-06-26 20:21:51 +08:00
|
|
|
#!/usr/bin/env python3
|
|
|
|
|
"""Scrub dangerous characters from a string before splicing into the RESULT block.
|
|
|
|
|
|
|
|
|
|
Strips characters that would corrupt the `KEY=VALUE` line format parsers use to read
|
|
|
|
|
the RESULT block: backtick, dollar, double-quote, backslash, CR, tab, NUL, newline.
|
|
|
|
|
|
|
|
|
|
Used when interpolating user-controlled values (session_id, org_alias, sf CLI stderr
|
|
|
|
|
excerpts) into ERROR_DETAIL and other RESULT fields. Without scrubbing, a malicious
|
|
|
|
|
or malformed input could inject fake KEY=VALUE pairs that downstream consumers
|
|
|
|
|
would treat as authoritative.
|
|
|
|
|
|
|
|
|
|
Usage:
|
2026-07-03 13:25:02 +08:00
|
|
|
_safe=$(python3 "$SKILL/scripts/sanitize.py" "$raw_value")
|
2026-06-26 20:21:51 +08:00
|
|
|
|
|
|
|
|
Arguments:
|
|
|
|
|
argv[1] raw string (may be empty)
|
|
|
|
|
|
|
|
|
|
Output:
|
|
|
|
|
stdout scrubbed string (no trailing newline)
|
|
|
|
|
exit 0 always (even on empty input)
|
|
|
|
|
"""
|
|
|
|
|
import sys
|
|
|
|
|
|
|
|
|
|
BAD = set("`$\"\\\r\t\0\n")
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def scrub(s: str) -> str:
|
|
|
|
|
return "".join(c for c in s if c not in BAD)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if __name__ == "__main__":
|
|
|
|
|
raw = sys.argv[1] if len(sys.argv) > 1 else ""
|
|
|
|
|
sys.stdout.write(scrub(raw))
|
