Skip to main content
← Back to list
01Issue
BugShippedSwamp CLI
Assigneesstack72

Relationships

#941 coerceToSuffix does not sanitize path-unsafe characters, causing forEach items and vary dimensions with / to produce invalid data instance names

Opened by jeremy · 7/3/2026· Shipped 7/3/2026

When a workflow forEach loop iterates over strings containing / (e.g. GitLab repo paths like o11n/macos-runner), the coerceToSuffix function in src/domain/workflows/data_suffix.ts returns the value verbatim via String(val). This unsanitized string is then used in two places:

  1. dataOutputOverrides vary suffix (execution_service.ts → data_writer.ts):

    instanceName = ${instanceName}-${override.resolvedVarySuffix}; // → "scan-o11n/macos-runner"

    The data repository rejects this with: Data name must not contain '..', '/', '', or null bytes (path traversal).

  2. reportVarySuffix (execution_service.ts line ~1132) — same unsanitized value used to namespace the @swamp/method-summary report, producing the same validation failure: Report @swamp/method-summary failed: Data name must not contain '/', ....

The scan resource itself succeeds if the extension's writeResource call manually sanitizes the name (e.g. projectPath.replaceAll("/", "--")), but that sanitization is not applied at the workflow layer.

Suggested fix: In coerceToSuffix, after String(val), apply the same sanitization the data repository enforces — replace /, , null bytes, and .. with a safe alternative (e.g. --):

export function coerceToSuffix(val: unknown): string { // ... existing object handling ... return String(val) .replace(/../g, "--") .replace(/[/\]/g, "--") .replace(/\0/g, ""); }

Reproduction: A forEach workflow step iterating over GitLab repo paths (format group/repo) with any dataOutputOverrides.vary referencing an input containing the path, or simply examining the step display name in the workflow run summary table.

02Bog Flow
✓OPEN✓TRIAGED✓IN PROGRESS✓SHIPPED+ 1 MOREASSIGNED+ 2 MOREREVIEW+ 4 MOREPR_MERGED+ 1 MORECONTRIBUTOR_NOTIFIED

Shipped

7/3/2026, 6:12:31 PM

Click a lifecycle step above to view its details.

03Sludge Pulse
stack72 assigned stack727/3/2026, 4:23:33 PM
Editable. Press Enter to edit.

stack72 commented 7/3/2026, 6:12:38 PM

Thanks @jeremy for reporting this! The fix has been merged and a release is on its way. We appreciate your contribution to swamp.

Sign in to post a ripple.