Found by the local review pass on the #1372 fix, all in labels_payload_ok in repo-config/configure.sh, and none introduced by that fix. Each was shown by running the function on a constructed payload, except where marked.
- Case folding is ASCII only. The duplicate-name test uses
ascii_downcase, so entries named É and é both pass, though GitHub compares names case-insensitively (not confirmed against the API).
- Name length is unbounded. An 80-character name passes, and GitHub is believed to cap label names at 50 characters, so
apply_labels would fail partway through, after the settings writes. A whitespace-only name also passes (not confirmed rejected by GitHub).
- A leading dash is accepted. A name such as
-h passes, and gh label create "$lname" would read it as a flag (from flag parsing, not run).
- Odd characters pass the character test. A NUL, vertical tab, or U+2028 in a name passes, and a NUL is dropped by the
rows substitution, so the label created differs from the one declared. jq also accepts nan as a document.
- Parse versus jq failure depends on jq's message text. The split keys on the words
parse error, which holds for jq 1.6 to 1.8 and not for gojq or jaq installed as jq.
Needs a decision on how far the contract should grow before it is changed, since each added check is a new place for a defect.
Found by the local review pass on the #1372 fix, all in
labels_payload_okinrepo-config/configure.sh, and none introduced by that fix. Each was shown by running the function on a constructed payload, except where marked.ascii_downcase, so entries namedÉandéboth pass, though GitHub compares names case-insensitively (not confirmed against the API).apply_labelswould fail partway through, after the settings writes. A whitespace-only name also passes (not confirmed rejected by GitHub).-hpasses, andgh label create "$lname"would read it as a flag (from flag parsing, not run).rowssubstitution, so the label created differs from the one declared. jq also acceptsnanas a document.parse error, which holds for jq 1.6 to 1.8 and not for gojq or jaq installed asjq.Needs a decision on how far the contract should grow before it is changed, since each added check is a new place for a defect.