sanitizeForPublic rewrites $USER as a word, corrupting the package name #46

New issue

Open

opened 2026-10-24 10:57:39 +00:00 by dsh · 0 comments

dsh commented

2026-10-24 10:57:39 +00:00

Owner

Problem

sanitizeForPublic() in lib/mirror-public.js scrubs process.env.USER / USERNAME as bare-word replacements:

const envUsers = [process.env.USER, process.env.USERNAME].filter(Boolean)
for (const u of allUsers) {
  res = res.replace(new RegExp(`\\b${escapeRegExp(u)}\\b`, 'g'), 'user')
}

On this host USER=dsh, so every occurrence of the package/plugin name dsh-gitea is rewritten to user-gitea in mirrored content. On a host where the login equals a common word, the same happens to unrelated text.

Impact

gitea_mirror_public and the new scripts/mirror-public.mjs are meant to produce a sanitized publish tree. With USER=dsh, the snapshot's README, package name references and docs are silently mangled while the report still says "sanitized" — a silent data-corruption path in a publishing tool.

Workaround

scripts/mirror-public.mjs clears USER/USERNAME around the sanitizeForPublic() call, so its output is correct. Direct callers (gitea_mirror_public) still hit the bug.

Expected

Only scrub the environment user when it is not a substring of the package identity, or drop the env-based scrub entirely and take explicit username/usernames options (the generic /home/<user>/ rewrite already covers paths). Add a regression test with USER=dsh asserting dsh-gitea survives.

Acceptance

sanitizeForPublic('dsh-gitea', {}) returns dsh-gitea with USER=dsh.
An explicit username: 'dsh' still scrubs that name.
npm test green.

## Problem `sanitizeForPublic()` in `lib/mirror-public.js` scrubs `process.env.USER` / `USERNAME` as bare-word replacements: ```js const envUsers = [process.env.USER, process.env.USERNAME].filter(Boolean) for (const u of allUsers) { res = res.replace(new RegExp(`\\b${escapeRegExp(u)}\\b`, 'g'), 'user') } ``` On this host `USER=dsh`, so every occurrence of the package/plugin name `dsh-gitea` is rewritten to `user-gitea` in mirrored content. On a host where the login equals a common word, the same happens to unrelated text. ## Impact `gitea_mirror_public` and the new `scripts/mirror-public.mjs` are meant to produce a sanitized publish tree. With `USER=dsh`, the snapshot's README, package name references and docs are silently mangled while the report still says "sanitized" — a silent data-corruption path in a publishing tool. ## Workaround `scripts/mirror-public.mjs` clears `USER`/`USERNAME` around the `sanitizeForPublic()` call, so its output is correct. Direct callers (`gitea_mirror_public`) still hit the bug. ## Expected Only scrub the environment user when it is not a substring of the package identity, or drop the env-based scrub entirely and take explicit `username`/`usernames` options (the generic `/home/<user>/` rewrite already covers paths). Add a regression test with `USER=dsh` asserting `dsh-gitea` survives. ## Acceptance - `sanitizeForPublic('dsh-gitea', {})` returns `dsh-gitea` with `USER=dsh`. - An explicit `username: 'dsh'` still scrubs that name. - `npm test` green.

dsh added the

area/forgejo

priority/next

type/bug

labels

2026-10-24 10:57:39 +00:00

dsh referenced this issue from a commit

2026-10-24 10:58:17 +00:00

docs(agents): index the two defects found by the README and mirror work