fix: escape Rich markup in catalog list output#3738
Open
Noor-ul-ain001 wants to merge 1 commit into
Open
Conversation
The `catalog list` subcommands for workflows, workflow steps, presets, and integrations printed user-editable catalog fields (name/url/ description from the `*-catalogs.yml` files) through `console.print` with Rich markup enabled. Any bracketed content such as a description `Does [stuff] nicely` was parsed as a style tag and silently swallowed, and a malformed tag could raise while rendering. Route each untrusted field through the module's already-imported `escape` helper, matching the pattern already used by `extension catalog list`. Adds regression tests for all four commands that inject bracketed name/url/description and assert the brackets survive verbatim in the output. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
catalog listsubcommands print user-editable catalog fields (name,url,descriptionfrom the*-catalogs.ymlconfig files) throughconsole.print, which has Rich markup enabled. Any bracketed content is parsed as a style tag and silently swallowed — e.g. a catalog descriptionDoes [stuff] nicelyrenders asDoes nicely— and a malformed tag can raise while rendering.This affects four commands whose sibling
extension catalog listalready escapes these fields:specify workflow catalog list(workflows/_commands.py)specify workflow step catalog list(workflows/_commands.py)specify preset catalog list(presets/_commands.py)specify integration catalog list(integrations/_query_commands.py)Fix
Route each untrusted field through the module's already-imported
escapehelper (from rich.markup import escape), matching the reference pattern inextension catalog list. No new imports.Tests
Adds a regression test per command that injects bracketed
name/url/descriptionand asserts the brackets survive verbatim in the output. Confirmed each test fails without the corresponding source fix (test-the-test via stash).The 20 unrelated
test_workflows.pysymlink-guard failures in my local run are pre-existing Windows-without-elevation failures, not touched by this change.🤖 Generated with Claude Code