Skip to content

Commit 722294b

Browse files
fix(local): sanitize trace.op and trace.status with stripAnsi
These fields were interpolated into terminal output without sanitization, unlike other user-controlled fields in the same function.
1 parent 580b6fe commit 722294b

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

src/commands/local.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -380,7 +380,7 @@ function formatTransactionItem(
380380

381381
const op = trace?.op;
382382
if (op && op !== "default" && op !== "unknown") {
383-
msg = `[${op}] ${msg}`;
383+
msg = `[${stripAnsi(op)}] ${msg}`;
384384
}
385385

386386
const start = event.start_timestamp as number | undefined;
@@ -392,7 +392,7 @@ function formatTransactionItem(
392392

393393
const status = trace?.status;
394394
if (status && status !== "ok") {
395-
msg += ` ${muted(`[${status}]`)}`;
395+
msg += ` ${muted(`[${stripAnsi(status)}]`)}`;
396396
}
397397

398398
const spans = event.spans as unknown[] | undefined;

0 commit comments

Comments
 (0)