From a7c18f54f73461dfd52e6d0082d33542fb0774fe Mon Sep 17 00:00:00 2001
From: Danny Avila <danny@librechat.ai>
Date: Sat, 23 May 2026 23:06:04 -0400
Subject: [PATCH] =?UTF-8?q?=F0=9F=AA=A4=20chore:=20Prevent=20CI=20Path=20A?=
 =?UTF-8?q?rgument=20Injection=20(#13284)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/eslint-ci.yml | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/eslint-ci.yml b/.github/workflows/eslint-ci.yml
index f03e88a7a7..85de6fa18e 100644
--- a/.github/workflows/eslint-ci.yml
+++ b/.github/workflows/eslint-ci.yml
@@ -44,14 +44,17 @@ jobs:
           echo "Base commit SHA: $BASE_SHA"
 
           # Get changed files (only JS/TS files in api/, client/, or packages/)
-          CHANGED_FILES=$(git diff --name-only --diff-filter=ACMRTUXB "$BASE_SHA" HEAD | grep -E '^(api|client|packages)/.*\.(js|jsx|ts|tsx)$' || true)
+          mapfile -d '' -t CHANGED_FILES < <(
+            git diff -z --name-only --diff-filter=ACMRTUXB "$BASE_SHA" HEAD |
+              grep -zE '^(api|client|packages)/.*\.(js|jsx|ts|tsx)$' || true
+          )
 
           # Debug output
           echo "Changed files:"
-          echo "$CHANGED_FILES"
+          printf '%s\n' "${CHANGED_FILES[@]}"
 
           # Ensure there are files to lint before running ESLint
-          if [[ -z "$CHANGED_FILES" ]]; then
+          if [[ ${#CHANGED_FILES[@]} -eq 0 ]]; then
             echo "No matching files changed. Skipping ESLint."
             exit 0
           fi
@@ -60,7 +63,7 @@ jobs:
           npx eslint --no-error-on-unmatched-pattern \
             --config eslint.config.mjs \
             --max-warnings=0 \
-            $CHANGED_FILES
+            -- "${CHANGED_FILES[@]}"
 
       # Run Prettier --check on the same set of changed files to catch
       # formatting drift in PRs that bypassed the local pre-commit hook
@@ -68,20 +71,23 @@ jobs:
       - name: Run Prettier --check on changed files
         run: |
           BASE_SHA=$(jq --raw-output .pull_request.base.sha "$GITHUB_EVENT_PATH")
-          CHANGED_FILES=$(git diff --name-only --diff-filter=ACMRTUXB "$BASE_SHA" HEAD | grep -E '^(api|client|packages)/.*\.(js|jsx|ts|tsx)$' || true)
+          mapfile -d '' -t CHANGED_FILES < <(
+            git diff -z --name-only --diff-filter=ACMRTUXB "$BASE_SHA" HEAD |
+              grep -zE '^(api|client|packages)/.*\.(js|jsx|ts|tsx)$' || true
+          )
 
-          if [[ -z "$CHANGED_FILES" ]]; then
+          if [[ ${#CHANGED_FILES[@]} -eq 0 ]]; then
             echo "No matching files changed. Skipping Prettier."
             exit 0
           fi
 
           echo "Files to check:"
-          echo "$CHANGED_FILES"
+          printf '%s\n' "${CHANGED_FILES[@]}"
 
           # `prettier --check` exits non-zero if any file would be reformatted.
           # Suggest the local fix in the failure message so contributors aren't
           # left guessing how to resolve.
-          if ! npx prettier --check --no-error-on-unmatched-pattern $CHANGED_FILES; then
+          if ! npx prettier --check --no-error-on-unmatched-pattern -- "${CHANGED_FILES[@]}"; then
             echo ""
             echo "::error::Prettier formatting drift detected. Fix locally with:"
             echo "::error::  npx prettier --write <files>"