diff --git a/src/github/operations/branch.ts b/src/github/operations/branch.ts index 870cd649..920eec56 100644 --- a/src/github/operations/branch.ts +++ b/src/github/operations/branch.ts @@ -58,16 +58,18 @@ export function validateBranchName(branchName: string): void { ); } - // Strict whitelist pattern: alphanumeric start, then alphanumeric/slash/hyphen/underscore/period/hash/plus. + // Strict whitelist pattern: alphanumeric start, then alphanumeric/slash/hyphen/underscore/period/hash/plus/comma. // # is valid per git-check-ref-format and commonly used in branch names like "fix/#123-description". // + is valid per git-check-ref-format and generated by Claude Code's EnterWorktree tool when // converting worktree names containing "/" (e.g. "feat/foo" becomes "worktree-feat+foo"). - // All git calls use execFileSync (not shell interpolation), so neither # nor + carries injection risk. - const validPattern = /^[a-zA-Z0-9][a-zA-Z0-9/_.#+-]*$/; + // , is valid per git-check-ref-format and commonly appears in branch names derived from titles + // or external identifiers (e.g. place names like "feature/paris,france"). + // All git calls use execFileSync (not shell interpolation), so none of these characters carry injection risk. + const validPattern = /^[a-zA-Z0-9][a-zA-Z0-9/_.#+,-]*$/; if (!validPattern.test(branchName)) { throw new Error( - `Invalid branch name: "${branchName}". Branch names must start with an alphanumeric character and contain only alphanumeric characters, forward slashes, hyphens, underscores, periods, hashes (#), or plus signs (+).`, + `Invalid branch name: "${branchName}". Branch names must start with an alphanumeric character and contain only alphanumeric characters, forward slashes, hyphens, underscores, periods, hashes (#), plus signs (+), or commas (,).`, ); } diff --git a/test/validate-branch-name.test.ts b/test/validate-branch-name.test.ts index 9594b48d..5a9bf680 100644 --- a/test/validate-branch-name.test.ts +++ b/test/validate-branch-name.test.ts @@ -55,6 +55,15 @@ describe("validateBranchName", () => { expect(() => validateBranchName("fix+issue-123")).not.toThrow(); expect(() => validateBranchName("feature+new-thing")).not.toThrow(); }); + + it("should accept branch names containing , (git-valid, common in title-derived branches)", () => { + // Reported in #1300: branches like "feature/a,b" were rejected, even though + // git check-ref-format and GitHub both accept commas. Common when branch names + // are derived from titles, place names, or external identifiers. + expect(() => validateBranchName("feature/a,b")).not.toThrow(); + expect(() => validateBranchName("feature/paris,france")).not.toThrow(); + expect(() => validateBranchName("fix/issue-1,2,3")).not.toThrow(); + }); }); describe("command injection attempts", () => {