redhat-et / redhat-et/docsclaw
fix: pass shell variables via env instead of interpolation in seed script
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 2
- Forks
- 1
- Avg merge
- 6h 9m
- Merged PRs (30d)
- 1
Description
From PR #66 review (GLM 5.1, finding #3):
seed-demo-data.sh interpolates $BASE_URL directly into a Python string,
which could break or allow code injection if the URL contains quotes.
Fix: pass via environment variable instead:
BASE_URL="$BASE_URL" python3 -c "import os; url = os.environ['BASE_URL'] + '/documents'"
Low risk — the script is developer-only tooling, not user-facing.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Open seed-demo-data.sh and find where BASE_URL is interpolated into the Python string. Replace that handoff with the environment-variable approach shown in the issue, then run the developer-only seed script to confirm it still constructs the /documents URL correctly and handles quoted URL values safely.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, shell
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 85/100