fix: Commit messages aren't fully shell escaped

`app` , "test", 'foo' Signed-off-by: Minsu Lee <[email protected]>
amondnet · Jun 27, 2022 · 13b5b55 · 13b5b55
1 parent 8ed64b8
commit 13b5b55
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/dist/index.js b/dist/index.js
diff --git a/index.js b/index.js
@@ -117,6 +117,8 @@ async function vercelDeploy(ref, commit) {
 
   const providedArgs = vercelArgs.split(/ +/);
 
+  const commitMessage = commit.replace("'", "'\\''");
+
   const args = [
     ...vercelArgs.split(/ +/),
     ...['-t', vercelToken],
@@ -134,8 +136,7 @@ async function vercelDeploy(ref, commit) {
     ...addVercelMetadata('githubCommitRepo', context.repo.repo, providedArgs),
     ...addVercelMetadata(
       'githubCommitMessage',
-      // eslint-disable-next-line prefer-template
-      '"' + commit + '"',
+      `'${commitMessage}'`,
       providedArgs,
     ),
     ...addVercelMetadata(