fix: update safe output regex and the docs (#1805)

Co-authored-by: jackton1 <jackton1@users.noreply.github.com> Co-authored-by: GitHub Action <action@github.com> Co-authored-by: Tonye Jack <jtonye@ymail.com>
tj-actions · Dec 23, 2023 · ff2f6e6 · ff2f6e6
1 parent 0102c07
commit ff2f6e6
Show file tree

Hide file tree

Showing 4 changed files with 44 additions and 16 deletions.
diff --git a/README.md b/README.md
@@ -572,6 +572,12 @@ Support this project with a :star:
     # Default: "\n"
     recover_files_separator: ''
 
+    # Apply sanitization to output filenames before being set as 
+    # output. 
+    # Type: boolean
+    # Default: "true"
+    safe_output: ''
+
     # Split character for output strings.
     # Type: string
     # Default: " "

diff --git a/dist/index.js b/dist/index.js
diff --git a/dist/index.js.map b/dist/index.js.map
diff --git a/src/utils.ts b/src/utils.ts
@@ -1355,7 +1355,10 @@ export const setOutput = async ({
 
   // if safeOutput is true, escape special characters for bash shell
   if (safeOutput) {
-    cleanedValue = cleanedValue.replace(/[$()`|&;]/g, '\\$&')
+    cleanedValue = cleanedValue.replace(
+      /[^\x20-\x7E]|[:*?"<>|;`$()&!]/g,
+      '\\$&'
+    )
   }
 
   core.setOutput(key, cleanedValue)