Bug: Unescaped regex metacharacters in frontmatter parser sed command
Resolved 💬 1 comment Opened Apr 23, 2026 by sakal-s Closed May 27, 2026
Description
In plugins/plugin-dev/skills/plugin-settings/scripts/parse-frontmatter.sh (line 51), field names are interpolated directly into a sed regex pattern without escaping special characters. If a field name contains regex metacharacters (., *, ?, [, ], etc.), the sed command will fail or match incorrectly.
Steps to Reproduce
- Have a frontmatter field with a name containing regex metacharacters, e.g.
my.setting - The sed pattern becomes
s/my.setting: *// .matches any character, somyXsetting: valuewould also match
Code
VALUE=$(echo "$FRONTMATTER" | grep "^${FIELD}:" | sed "s/${FIELD}: *//" | ...)
Expected Behavior
Field names should be escaped before being used in sed regex patterns.
Suggested Fix
Escape the field name before interpolation:
ESCAPED_FIELD=$(printf '%s\n' "$FIELD" | sed -e 's/[]\/$*.^[]/\\&/g')
VALUE=$(echo "$FRONTMATTER" | grep "^${FIELD}:" | sed "s/${ESCAPED_FIELD}: *//" | ...)
Note
The same issue exists in plugins/plugin-dev/skills/plugin-settings/scripts/validate-settings.sh (line 77).
This issue has 1 comment on GitHub. Read the full discussion on GitHub ↗