{"record":{"id":"d4359c177d286aac","repo":"abhigyanpatwari/GitNexus","slug":"must-not-contain-backticks","errorCode":null,"errorMessage":"must not contain backticks","messagePattern":"must not contain backticks","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"gitnexus/src/core/auto-sync/config.ts","lineNumber":342,"sourceCode":"    repoName === 'unknown' ||\n    repoName.startsWith('-') ||\n    !REMOTE_REPO_NAME_PATTERN.test(repoName)\n  ) {\n    throw new Error(\n      'repository name must use only letters, digits, \".\", \"_\", or \"-\" and must not be \"unknown\"',\n    );\n  }\n}\n\nexport function validateAutoSyncBranchName(branch: string): void {\n  if (!branch.trim()) throw new Error('must not be empty');\n  if (/[\\s\\0-\\x1f\\x7f]/.test(branch))\n    throw new Error('must not contain whitespace or control characters');\n  if (/[~^:?*[\\\\]/.test(branch)) throw new Error('contains characters not allowed in a git ref');\n  if (branch.startsWith('-')) throw new Error('must not start with \"-\"');\n  if (branch.startsWith('/')) throw new Error('must not start with \"/\"');\n  if (branch.includes('..')) throw new Error('must not contain \"..\"');\n  if (branch.includes('`')) throw new Error('must not contain backticks');\n  if (branch.endsWith('/') || branch.endsWith('.')) throw new Error('must not end with \"/\" or \".\"');\n  if (branch.includes('//')) throw new Error('must not contain consecutive slashes');\n  if (branch.includes('@{')) throw new Error('must not contain \"@{\"');\n  if (\n    branch\n      .split('/')\n      .some(\n        (component) =>\n          component.startsWith('.') || component.endsWith('.') || component.endsWith('.lock'),\n      )\n  )\n    throw new Error('must not contain hidden, trailing-dot, or .lock path components');\n}\n\nexport function parseDurationMs(value: unknown): number {\n  if (typeof value === 'number') return value * 1_000;\n  const raw = String(value ?? '').trim();\n  const match = /^(\\d+)(ms|s|m)?$/.exec(raw);","sourceCodeStart":324,"sourceCodeEnd":360,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/0d1aed942f0e8b5d3bac27519fff441aceea722d/gitnexus/src/core/auto-sync/config.ts#L324-L360","documentation":"validateAutoSyncBranchName rejects branch names containing backticks, because git refs and the shell command construction around them treat backticks as command substitution. The auto-sync config parser calls this validator on every configured branch name, so a backtick in the config can never reach git. The check prevents both shell-injection and invalid-ref errors downstream.","triggerScenarios":"Calling parseAutoSyncConfig with an auto-sync branch config value containing a backtick character anywhere in the name, e.g. branch: \"main`id`\" or \"feature/`date`\"","commonSituations":"Users pasting shell-style command-substitution snippets into config files, templated configs where a placeholder was written with backticks (e.g. `DATE`) and never substituted, or YAML values copied from shell scripts.","solutions":["Remove all backtick characters from the configured branch name in the auto-sync config.","If a dynamic name was intended, resolve it before writing config (compute the branch name in code, not via shell substitution).","Re-run config parsing to confirm the branch passes validateAutoSyncBranchName."],"exampleFix":"// before\nbranch: \"release-`date +%Y`\"\n// after\nbranch: \"release-2026\"","handlingStrategy":"validation","validationCode":"if (typeof branch === 'string' && branch.includes('`')) throw new Error('branch name must not contain backticks');","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never paste shell command-substitution syntax into branch-name config fields.","Lint config files for backticks with a simple regex check in CI.","Document that auto-sync branch names follow git check-ref-format rules."],"tags":["config","git","validation","auto-sync"],"backgroundTag":"invalid-config-value","analyzedSha":"0d1aed942f0e8b5d3bac27519fff441aceea722d","analyzedAt":"2026-09-08T00:40:44.970Z","contentChangedAt":"2026-09-08T00:40:44.970Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}