Bug: Unescaped regex metacharacters in frontmatter parser sed command

Resolved 💬 1 comment Opened Apr 23, 2026 by sakal-s Closed May 27, 2026

Description

In plugins/plugin-dev/skills/plugin-settings/scripts/parse-frontmatter.sh (line 51), field names are interpolated directly into a sed regex pattern without escaping special characters. If a field name contains regex metacharacters (., *, ?, [, ], etc.), the sed command will fail or match incorrectly.

Steps to Reproduce

  1. Have a frontmatter field with a name containing regex metacharacters, e.g. my.setting
  2. The sed pattern becomes s/my.setting: *//
  3. . matches any character, so myXsetting: value would also match

Code

VALUE=$(echo "$FRONTMATTER" | grep "^${FIELD}:" | sed "s/${FIELD}: *//" | ...)

Expected Behavior

Field names should be escaped before being used in sed regex patterns.

Suggested Fix

Escape the field name before interpolation:

ESCAPED_FIELD=$(printf '%s\n' "$FIELD" | sed -e 's/[]\/$*.^[]/\\&/g')
VALUE=$(echo "$FRONTMATTER" | grep "^${FIELD}:" | sed "s/${ESCAPED_FIELD}: *//" | ...)

Note

The same issue exists in plugins/plugin-dev/skills/plugin-settings/scripts/validate-settings.sh (line 77).

View original on GitHub ↗

This issue has 1 comment on GitHub. Read the full discussion on GitHub ↗