tenant.openagents/omega

1use annotate_snippets::{AnnotationKind, Group, Level, Snippet};
2use regex::Regex;
3use std::{collections::HashMap, ops::Range, path::Path, sync::LazyLock};
4
5static GITHUB_INPUT_PATTERN: LazyLock<Regex> = LazyLock::new(|| {
6    Regex::new(r#"\$\{\{[[:blank:]]*([[:alnum:]]|[[:punct:]])+?[[:blank:]]*\}\}"#)
7        .expect("Should compile")
8});
9
10pub struct RunValidationError {
11    found_injection_patterns: Vec<(String, Range<usize>)>,
12}
13
14impl RunValidationError {
15    /// Renders the GitHub input injection patterns found in a single `run:`
16    /// command as one diagnostic group.
17    pub fn annotation_group<'a>(&self, file_path: &Path, raw_content: &'a str) -> Group<'a> {
18        let mut identical_lines = HashMap::new();
19
20        let ranges = self
21            .found_injection_patterns
22            .iter()
23            .map(|(line, pattern_range)| {
24                let initial_offset = identical_lines
25                    .get(&(line.as_str(), pattern_range.start))
26                    .copied()
27                    .unwrap_or_default();
28
29                let line_start = raw_content[initial_offset..]
30                    .find(line.as_str())
31                    .map(|offset| offset + initial_offset)
32                    .unwrap_or_default();
33
34                let pattern_start = line_start + pattern_range.start;
35                let pattern_end = pattern_start + pattern_range.len();
36
37                identical_lines.insert((line.as_str(), pattern_range.start), pattern_end);
38
39                pattern_start..pattern_end
40            });
41
42        Level::ERROR
43            .primary_title("Found GitHub input injection in run command")
44            .element(
45                Snippet::source(raw_content)
46                    .path(file_path.display().to_string())
47                    .annotations(ranges.map(|range| {
48                        AnnotationKind::Primary
49                            .span(range)
50                            .label("This should be passed via an environment variable")
51                    })),
52            )
53    }
54}
55
56pub fn validate_run_command(command: &str) -> Result<(), RunValidationError> {
57    let patterns: Vec<_> = command
58        .lines()
59        .flat_map(move |line| {
60            GITHUB_INPUT_PATTERN
61                .find_iter(line)
62                .map(|m| (line.to_owned(), m.range()))
63        })
64        .collect();
65
66    if patterns.is_empty() {
67        Ok(())
68    } else {
69        Err(RunValidationError {
70            found_injection_patterns: patterns,
71        })
72    }
73}
74