starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-19 00:02:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(powershell): escape configured repo URL/PAT in install script too

Browse Source 
The module-install template interpolates the configured private repo URL and
PAT into single-quoted PowerShell literals ($privateRepoUrl/$privateRepoPat),
the same sink as the module names. Escape ' -> '' there as well so a quote in
the configured value can't break out of the literal.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ruben Fiszel
2026-06-15 15:37:13 +00:00
parent eb342575fb
commit db1dbe9e81
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-worker/src/pwsh_executor.rs
+6 -2
View File
@@ -554,13 +554,17 @@ pub async fn handle_powershell_job(
.replace("{job_id}", &job.id.to_string())
.replace("{has_private_repo}", &format!("${has_private_repo}"))
.replace("{has_credentials}", &format!("${has_credentials}"))
// Escape single quotes: these are interpolated into single-quoted
// PowerShell literals ($privateRepoUrl/$privateRepoPat) in the install
// script, so an unescaped quote in the configured repo URL/PAT would
// break out of the literal (same sink as the module names above).
.replace(
"{private_repo_url}",
&powershell_repo_url.unwrap_or_default(),
&powershell_repo_url.unwrap_or_default().replace("'", "''"),
)
.replace(
"{private_repo_pat}",
&powershell_repo_pat.unwrap_or_default(),
&powershell_repo_pat.unwrap_or_default().replace("'", "''"),
)
.replace("{modules}", &modules_list);
let mut cmd = Command::new(POWERSHELL_PATH.as_str());