Summary
Next in the #1123/#1234/#1246/#1247/#1253/#1254 chain. repo-config/configure.sh's check_environments() percent-encodes an environment name with a plain jq -rn, one line above interpolating the result into an API URL, the same pattern #1253 fixes for a ruleset id.
The defect
ename_uri="$(jq -rn --arg s "$ename" '$s|@uri')"
if ! policies="$(gh api --paginate "repos/$repo/environments/$ename_uri/deployment-branch-policies" --jq '.branch_policies[]' | jq -s '.')"; then
(repo-config/configure.sh, check_environments(), around line 676.) On a native Windows jq, -r raw-output mode appends a trailing \r after @uri percent-encoding runs, so $ename_uri carries the CR past the encoding step. That reaches gh api as part of the URL path segment, breaking the request the same way a CR-suffixed ruleset id breaks the rulesets/<id> fetch in #1253. The if ! policies=... guard catches the resulting failure and reports it as fail "environment '$ename' - could not read its deployment branch policies", so every environment with a custom branch policy on such a host reports this failure rather than the drift (or lack of it) check_environments() exists to detect.
This is the same CRLF-exposure class #1123/#1234/#1246/#1247/#1253/#1254 already fixed at other sites in the same file, in check_environments() rather than check_ruleset()/ruleset_id().
Suggested fix
Route the extraction through jqr() (already in scope in this function - the surrounding reads at the same call site already use it), i.e. jqr -n --arg s "$ename" '$s|@uri'.
Context
Found via an adversarial local-review pass dispatched while fixing #1253. Filed separately to keep that PR scoped to its assigned line.
Unverified on a real Windows host, same as #1123/#1234/#1246/#1247/#1253/#1254.
Summary
Next in the #1123/#1234/#1246/#1247/#1253/#1254 chain.
repo-config/configure.sh'scheck_environments()percent-encodes an environment name with a plainjq -rn, one line above interpolating the result into an API URL, the same pattern #1253 fixes for a ruleset id.The defect
(
repo-config/configure.sh,check_environments(), around line 676.) On a native Windows jq,-rraw-output mode appends a trailing\rafter@uripercent-encoding runs, so$ename_uricarries the CR past the encoding step. That reachesgh apias part of the URL path segment, breaking the request the same way a CR-suffixed ruleset id breaks therulesets/<id>fetch in #1253. Theif ! policies=...guard catches the resulting failure and reports it asfail "environment '$ename' - could not read its deployment branch policies", so every environment with a custom branch policy on such a host reports this failure rather than the drift (or lack of it)check_environments()exists to detect.This is the same CRLF-exposure class #1123/#1234/#1246/#1247/#1253/#1254 already fixed at other sites in the same file, in
check_environments()rather thancheck_ruleset()/ruleset_id().Suggested fix
Route the extraction through
jqr()(already in scope in this function - the surrounding reads at the same call site already use it), i.e.jqr -n --arg s "$ename" '$s|@uri'.Context
Found via an adversarial local-review pass dispatched while fixing #1253. Filed separately to keep that PR scoped to its assigned line.
Unverified on a real Windows host, same as #1123/#1234/#1246/#1247/#1253/#1254.