fix(cve-json): keep JSON escapes intact when replacing an embedded attachment - #1377
Merged
Merged
Conversation
…tachment _splice_attachment_into_body replaced an existing CVE-JSON block with re.sub and a string replacement. re.sub processes backslash escapes in a string replacement, so every JSON "\n" escape inside a string value (for example a multi-paragraph summary) became a real newline and the embedded JSON no longer parsed. Only the replace path was affected; the first append does not go through re.sub. Pass the replacement as a callable so it is inserted verbatim, and add a regression test covering \n, \\ and \1 in the attachment JSON. Generated-by: Claude Opus 5
potiuk
added
the
contract:cve-authority
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem: Re-attaching CVE JSON to a tracker that already has an attachment
produced invalid embedded JSON whenever a string value contained escapes, for
example a multi-paragraph summary.
Root cause:
_splice_attachment_into_bodypassed a string replacement tore.sub.re.subprocesses backslash escapes in a string replacement, so eachJSON
\nbecame a real newline. Only the replace path was affected; the firstappend does not use
re.sub.Fix: Pass a callable (
lambda _: replacement) so the text is inserted verbatim.Test: A new regression test covers
\n,\\and\1. It fails before thefix and passes after; the full suite of 347 tests passes.
Impact: Any tracker re-attached with a summary containing escapes, typically a
multi-paragraph one, had invalid embedded JSON. Re-running the attachment after
this fix repairs it.
🤖 Generated with Claude Code