fix(security): validate remote URL and escape commit messages in generate-release.ps1

[xiaolai]

Automated audit: This PR was generated by NLPM, a natural language programming linter, running via claude-code-action. Please evaluate the diff on its merits.

Security Issues (Medium)

commands/generate-release.ps1 has two related content-injection risks:

1. Untrusted origin remote URL

The script calls git remote get-url origin and derives $repoPath from the result, which it then passes directly to gh api "repos/$repoPath/commits/$sha". If an attacker can modify the origin remote (e.g. via git remote set-url origin), the script will make GitHub API calls for an attacker-controlled repo and embed that repo's data into the release notes.

2. Unsanitized commit message in markdown output

Commit subjects (git log --pretty=format:'%s') are written verbatim into the release notes file:

Add-Content -Path $filename -Value "- [``$shortSha``]($repoUrl/commit/$sha) — $message by @$username"

A commit subject like [evil link](https://attacker.example) or <script>alert(1)</script> would be rendered as-is if the markdown file is published or displayed in a web context.

Fix

Remote URL validation — added a regex guard immediately after parsing $repoUrl. If the URL does not match the expected https://github.com/owner/repo pattern, the script aborts before making any API call:

if ($repoUrl -notmatch '^https://github\.com/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$') {
    Write-Error "Unexpected remote URL '$repoUrl' — aborting to prevent unintended GitHub API calls."
    Pop-Location
    exit 1
}

Commit message escaping — markdown brackets and HTML angle brackets are escaped before writing to the output file:

$safemessage = $message -replace '\[', '\[' -replace '\]', '\]' -replace '<', '&lt;' -replace '>', '&gt;'
Add-Content -Path $filename -Value "- [``$shortSha``]($repoUrl/commit/$sha) — $safemessage by @$username"

Both changes are additive — no existing functionality is affected.

[Copilot]

Pull request overview

This PR hardens the commands/generate-release.ps1 helper script against content injection by validating the origin remote URL before using it in GitHub API requests, and by escaping commit subjects before emitting them into release-note markdown.

Changes:

• Added a guard to reject unexpected origin remote URL formats before calling gh api.
• Escaped certain markdown/HTML characters in commit subjects before writing release notes.

[Copilot]

The remote URL validation only checks that the URL is on github.com and has an owner/repo shape, but it still allows origin to point to a different GitHub repository. That means a tampered remote can still cause gh api repos/$repoPath/... to fetch and embed data from an attacker-controlled repo. Consider sourcing the repo identity from a trusted channel when available (e.g., $env:GITHUB_REPOSITORY in CI) and/or adding an explicit -RepoPath/-RepoUrl parameter, and then validating that the remote-derived value matches it before continuing.

[Copilot]

The URL regex is very strict and will reject common valid git remote formats like ssh://git@github.com/owner/repo(.git) or a trailing slash. If contributors use those remote URL styles, the script will now fail even though the repo is legitimate. Consider normalizing additional git remote URL formats to the canonical https URL before validation, or extending the validation to accept those equivalent forms.

[Copilot]

Escaping </> without escaping & first can be bypassed by a commit subject containing pre-escaped entities like <script>.... Consider performing proper HTML escaping (escape & before </>, or use a built-in HTML encoder) before writing the message into markdown.

Suggested change

	# Escape markdown special characters in commit message to prevent content injection
	$safemessage = $message -replace '\[', '\[' -replace '\]', '\]' -replace '<', '&lt;' -replace '>', '&gt;'
	# Escape HTML first, then escape markdown link delimiters in the commit message to prevent content injection
	$safemessage = [System.Net.WebUtility]::HtmlEncode($message) -replace '\[', '\[' -replace '\]', '\]'

[Copilot]

Variable name $safemessage is inconsistent with the casing used elsewhere in this script (e.g., $repoUrl, $shortSha). Consider renaming to $safeMessage for readability and consistency.

[IvanMurzak]

There are critical issues were detected by Copilot

[github-actions]

Test Results

   12 files    468 suites   40m 37s ⏱️
  799 tests   799 ✅ 0 💤 0 ❌
4 794 runs  4 794 ✅ 0 💤 0 ❌

Results for commit 03cea9a.