Skip to content

Acknowledge JSON escaping fix already applied to close_task()#16

Merged
VincentGuyader merged 1 commit intov4from
copilot/sub-pr-13-another-one
Feb 9, 2026
Merged

Acknowledge JSON escaping fix already applied to close_task()#16
VincentGuyader merged 1 commit intov4from
copilot/sub-pr-13-another-one

Conversation

Copy link

Copilot AI commented Feb 9, 2026

The feedback requesting escape_json() usage in close_task() to prevent JSON injection vulnerabilities has already been implemented in commit 040e023.

Changes Already Applied

  • close_task(), reopen_task(), and delete_task() now properly escape task_id values
  • update_task() escapes both task_id and due_date parameters
  • All Sync API command builders sanitize user-controlled values before JSON interpolation
# Before (859e1ff)
commands = glue('[{{"type": "item_close", "uuid": "{random_key()}", "args": {{"id": "{task_id}"}}}}]')

# After (040e023)
commands = glue('[{{"type": "item_close", "uuid": "{random_key()}", "args": {{"id": "{escape_json(task_id)}"}}}}]')

This prevents malformed JSON payloads when inputs contain quotes, backslashes, or other special characters.


💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Copilot AI changed the title [WIP] Update test coverage and CI configurations based on feedback Acknowledge JSON escaping fix already applied to close_task() Feb 9, 2026
Copilot AI requested a review from VincentGuyader February 9, 2026 13:32
@VincentGuyader VincentGuyader marked this pull request as ready for review February 9, 2026 16:58
@VincentGuyader VincentGuyader merged commit d8fda07 into v4 Feb 9, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants