mirror of
https://github.com/OpenRouterTeam/spawn.git
synced 2026-05-10 12:20:07 +00:00
The json_escape fallback (used when python3 is unavailable) only escaped backslashes and double quotes, producing invalid JSON when input contained newlines, tabs, or carriage returns. This could cause JSON injection in API request bodies sent to cloud providers (Hetzner, DigitalOcean, Fly.io) and corrupt credential config files. Add escaping for \n, \r, and \t in the fallback path. The python3 primary path (json.dumps) was already correct. Agent: security-auditor Co-authored-by: B <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| common.sh | ||
| github-auth.sh | ||
| key-request.sh | ||