actions/claude-code-action
1
0
Fork 0
mirror of https://github.com/anthropics/claude-code-action.git synced 2026-08-03 09:48:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: allow leading underscore in branch names (valid per git-check-ref-format) (#1486)

Browse Source 
Branch names starting with an underscore (e.g. _release/v1.2.3) are valid
per git check-ref-format but were rejected by validateBranchName's
first-character whitelist. Since setupBranch validates a PR's baseRefName
after checkout, the action failed on every open PR targeting such a
branch. A leading underscore carries no option-injection risk (only a
leading dash does, which is still rejected separately).

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Riley Mete 2026-07-15 20:27:12 -07:00 committed by GitHub
parent 214a70611b
commit 5bfa96a5b0
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/github/operations/branch.ts
View File

@ -27,7 +27,7 @@ function extractFirstLabel(githubData: FetchDataResult): string | undefined {
* This prevents command injection by ensuring only safe characters are used.
*
* Valid branch names:
* - Start with alphanumeric character or @ (not dash, to prevent option injection)
* - Start with alphanumeric character, underscore, or @ (not dash, to prevent option injection)
* - Contain only alphanumeric, forward slash, hyphen, underscore, period, hash (#), plus (+), comma (,), or at sign (@)
* - Do not start or end with a period
* - Do not end with a slash
@ -68,12 +68,15 @@ export function validateBranchName(branchName: string): void {
// @ is valid per git-check-ref-format anywhere in a ref name, including the first character
// (e.g. ticket conventions like "TICKET-123@add-feature" or prefixes like "@hotfix/...");
// the bare name "@" (HEAD shorthand) and the "@{" sequence (reflog syntax) are rejected below.
// _ is valid per git-check-ref-format anywhere in a ref name, including the first character;
// leading underscores are a common convention for release/internal branches (e.g.
// "_release/v1.2.3"), which previously failed validation as a PR's base branch.
// All git calls use execFileSync (not shell interpolation), so none of these characters carry injection risk.
const validPattern = /^[a-zA-Z0-9@][a-zA-Z0-9/_.#+,@-]*$/;
const validPattern = /^[a-zA-Z0-9@_][a-zA-Z0-9/_.#+,@-]*$/;
if (!validPattern.test(branchName)) {
throw new Error(
`Invalid branch name: "${branchName}". Branch names must start with an alphanumeric character or '@' and contain only alphanumeric characters, forward slashes, hyphens, underscores, periods, hashes (#), plus signs (+), commas (,), or at signs (@).`,
`Invalid branch name: "${branchName}". Branch names must start with an alphanumeric character, underscore, or '@' and contain only alphanumeric characters, forward slashes, hyphens, underscores, periods, hashes (#), plus signs (+), commas (,), or at signs (@).`,
);
}

10
test/validate-branch-name.test.ts
View File

@ -74,6 +74,16 @@ describe("validateBranchName", () => {
expect(() => validateBranchName("@hotfix/login-timeout")).not.toThrow();
expect(() => validateBranchName("agent/task@abc123")).not.toThrow();
});
it("should accept branch names starting with underscore (git-valid, common for release branches)", () => {
// Leading underscores are valid per git check-ref-format and a common
// convention for release/internal branches. Rejecting them broke the
// action on any open PR whose base branch was e.g. "_release/v1.2.3",
// since setupBranch validates the PR's baseRefName after checkout.
expect(() => validateBranchName("_release/v1.2.3")).not.toThrow();
expect(() => validateBranchName("_internal")).not.toThrow();
expect(() => validateBranchName("_wip/feature-x")).not.toThrow();
});
});
describe("command injection attempts", () => {