fleet/changes/43955-gitops-escape-json-in-vars at 227e94de5b279decf0dec83550dd2eaa273aed56 - Elgato_dark/fleet - Forgejo: Beyond coding. We Forge.

Elgato_dark/fleet

mirror of https://github.com/fleetdm/fleet synced 2026-05-24 09:28:54 +00:00

Martin Angers 5da912a33e

Bugfix: escape characters not supported in JSON when resolving variables (#43955 )

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #38013 

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

See
https://drive.google.com/file/d/1zeFNLuf_rT5FWzDiYyL2_hbIBW2neba-/view?usp=drive_link

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* GitOps variables in JSON configuration profiles (Apple DDM
declarations and Android profiles) are now automatically escaped for
JSON special characters, ensuring proper handling of sensitive values.

* **Tests**
* Added JSON configuration profile escaping validation to the enterprise
GitOps integration test suite.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

2026-04-23 10:34:12 -06:00

1 line

153 B

Text

Raw Blame History

- Automatically escape JSON special characters in GitOps variables used in `.json` configuration profiles (Apple DDM declarations and Android profiles).