022-github-actions-command-injection-via-timeout-test-name.patch

diff --git a/src/runtime/cli/test_command.rs b/src/runtime/cli/test_command.rs
index 70691b02a4..1c3f895c30 100644
--- a/src/runtime/cli/test_command.rs
+++ b/src/runtime/cli/test_command.rs
@@ -199,7 +199,38 @@ pub fn escape_xml(str_: &[u8], writer: &mut impl bun_io::Write) -> Result<(), bu
     Ok(())
 }
 
-fn fmt_status_text_line(
+struct GithubActionProperty<'a>(&'a [u8]);
+
+impl core::fmt::Display for GithubActionProperty<'_> {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        let mut last: usize = 0;
+        for (i, byte) in self.0.iter().copied().enumerate() {
+            let escaped = match byte {
+                b'%' => "%25",
+                b'\r' => "%0D",
+                b'\n' => "%0A",
+                b':' => "%3A",
+                b',' => "%2C",
+                _ => continue,
+            };
+            if i > last {
+                write!(f, "{}", bstr::BStr::new(&self.0[last..i]))?;
+            }
+            f.write_str(escaped)?;
+            last = i + 1;
+        }
+        if last < self.0.len() {
+            write!(f, "{}", bstr::BStr::new(&self.0[last..]))?;
+        }
+        Ok(())
+    }
+}
+
+fn github_action_property(value: &[u8]) -> GithubActionProperty<'_> {
+    GithubActionProperty(value)
+}
+
+fn fmt_status_text_line(
     status: bun_test::Execution::Result,
     emoji_or_color: bool,
 ) -> Output::PrettyBuf {
@@ -951,7 +982,7 @@ impl CommandLineReporter {
                     if Output::is_github_action() {
                         Output::print_error(format_args!(
                             "::error title=error: Test \"{}\" timed out after {}ms::\n",
-                            bstr::BStr::new(display_label),
+                            github_action_property(display_label),
                             test_entry.timeout
                         ));
                         Output::flush();