Skip to content

fix(examples): replace unsafe eval in title.sh with safe read block - #872

Open
AbhiPra24 wants to merge 1 commit into
google-antigravity:mainfrom
AbhiPra24:fix/title-eval-safety
Open

fix(examples): replace unsafe eval in title.sh with safe read block#872
AbhiPra24 wants to merge 1 commit into
google-antigravity:mainfrom
AbhiPra24:fix/title-eval-safety

Conversation

@AbhiPra24

Copy link
Copy Markdown

Summary of Changes

  • Replaced the unsafe eval $(echo "$DATA" | jq ...) pattern in examples/title/title.sh with a safe multi-line read -r block.
  • Prevents potential shell command injection if untrusted or malformed directory paths/metadata are passed in the JSON payload.
  • Aligns with the robust parsing pattern used in examples/statusline/statusline.sh.

Verification

  • Executed examples/title/title.sh against simulated agent JSON payloads ({"agent_state": "working", "workspace": {"current_dir": "/path/to/project"}}).
  • Verified expected clean emoji and workspace title generation without shell evaluation vulnerabilities.

@google-cla

google-cla Bot commented Aug 25, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@AbhiPra24
AbhiPra24 force-pushed the fix/title-eval-safety branch from fe674e3 to a3706a4 Compare August 25, 2026 18:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant