fix: escape spec-controlled strings in generated template literals and object keys (#3692)

* fix(core,zod): escape spec-controlled strings in generated template literals

Unescaped spec values (servers[].url, path segments, schema defaults)
were baked into generated template literals, allowing code injection via
backtick or ${ in an attacker-controlled OpenAPI spec.

Uses jsesc with quotes: 'backtick' to escape at three boundaries:
- getRoute(): raw OpenAPI path before param processing
- getFullRoute(): resolved server URL after variable substitution
- formatDefaultValue(): schema default values in zod generation

Addresses: GHSA-88f2-fpv8-89q2, GHSA-w727-8j6c-2rj4,
GHSA-3575-w9fc-c2j6, GHSA-2h9g-j24r-h63g, GHSA-8j6p-r8jg-mxqh,
GHSA-p4cg-3328-rvfg

* fix(zod): escape object keys via JSON.stringify in zod.object generation

Unescaped schema property and parameter names were emitted as
double-quoted keys in zod.object({...}), allowing computed property key
injection via " in the name.

Replaces "${key}" with JSON.stringify(key) at all 5 render sites.

Addresses: GHSA-6437-gxhq-pqv8, GHSA-653q-5476-x79g, GHSA-6mr6-jvcr-2f25

* fix(core): escape single-quoted object keys in getKey via jsStringLiteralEscape

Unescaped schema property names were wrapped in single quotes by getKey(),
allowing computed property key injection via ' in the name in MSW mock output.

Wraps the key body with jsStringLiteralEscape before quoting.

Addresses: GHSA-2w86-xfrc-g85r

* fix(query,zod): escape raw route prefix and prove backtick-in-key safety

mutation-generator.ts passed a raw spec path prefix to getFullRoute,
bypassing getRoute's escaping. Wrap with getRoute to close the gap.

Add test proving JSON.stringify-wrapped object keys are safe against
backtick injection (backtick is harmless inside double-quoted strings).

* fix: escape object-default keys and add ${} path test

- Escape object-default keys with JSON.stringify in zod schema defaults
  (same fix as zod.object keys)
- Add test verifying ${globalThis.X} in path segments is not
  re-interpreted as interpolation
- Update existing test expectations for quoted object keys

* fix(core): prevent ${} re-interpretation in getRoutePath and escape single quotes in getRouteAsArray

getRoutePath: after jsesc escapes ${ to \${, the remaining {evil} was
mistaken for an OpenAPI path param and re-converted to ${evil}. Add
early-return when { is preceded by $.

getRouteAsArray: segments wrapped in single-quoted strings without
escaping '. A spec path containing ' would break out. Now escapes
single quotes at both wrap sites.

* fix(core): handle ${} in getRoutePath and escaped tags in getRouteAsArray

getRoutePath: skip past ${...} block and continue processing remaining
suffix so later {param} segments are still converted.

getRouteAsArray: add (?<!\) to split/match regexes so jsesc-escaped
${...} is treated as literal text, preventing standalone backslash
from breaking single-quote wrapping.

* fix(core): escape per-segment in getRoute to preserve params after ${...}

Author: aqeelat

bun.lock

@@ -31,6 +31,7 @@
     "esutils": "2.0.3",
     "fs-extra": "^11.3.2",
     "jiti": "^2.6.1",
+    "jsesc": "^3.0.0",
     "remeda": "^2.33.6",
     "tinyglobby": "^0.2.16",
     "typedoc": "^0.28.19"
@@ -40,6 +41,7 @@
     "@types/debug": "^4.1.12",
     "@types/esutils": "^2.0.2",
     "@types/fs-extra": "^11.0.4",
+    "@types/jsesc": "^3.0.3",
     "rimraf": "catalog:",
     "typescript": "catalog:",
     "vitest": "catalog:"

packages/core/package.json

@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest';
+
+import { getKey } from './keys';
+
+describe('getKey', () => {
+  it('escapes single quote in key', () => {
+    const result = getKey("x':[require('fs').execSync('id'),");
+    expect(result).toMatch(/^'(.*)'$/);
+    const inner = result.slice(1, -1);
+    expect(inner).not.toMatch(/(?<!\\)'/);
+  });
+
+  it('escapes backslash in key', () => {
+    const result = getKey('a\\b');
+    expect(result).toBe(String.raw`'a\\b'`);
+  });
+});

packages/core/src/getters/keys.test.ts

@@ -1,5 +1,9 @@
 import { keyword } from 'esutils';
 
+import { jsStringLiteralEscape } from '../utils';
+
 export function getKey(key: string) {
-  return keyword.isIdentifierNameES5(key) ? key : `'${key}'`;
+  return keyword.isIdentifierNameES5(key)
+    ? key
+    : `'${jsStringLiteralEscape(key)}'`;
 }

packages/core/src/getters/keys.ts

@@ -202,6 +202,118 @@ describe('getFullRoute getter', () => {
   }
 });
 
+describe('getFullRoute — GHSA-88f2-fpv8-89q2: servers[].url template-literal injection', () => {
+  it('escapes backtick in server URL', () => {
+    const servers: OpenApiServerObject[] = [
+      {
+        url: 'http://api.x/`+require("fs").writeFileSync("/marker","pwned")+`',
+      },
+    ];
+    const result = getFullRoute('/path', servers, {
+      getBaseUrlFromSpecification: true,
+    });
+    expect(result).not.toMatch(/(?<!\\)`/);
+    expect(result).toContain('\\`+require');
+  });
+
+  it('escapes ${ in server URL', () => {
+    const servers: OpenApiServerObject[] = [
+      {
+        url: 'http://api.x/${globalThis.X = require("fs").writeFileSync("/marker","pwned")}/v1',
+      },
+    ];
+    const result = getFullRoute('/path', servers, {
+      getBaseUrlFromSpecification: true,
+    });
+    expect(result).not.toMatch(/(?<!\\)\$\{/);
+    expect(result).toContain('\\${globalThis');
+  });
+
+  it('escapes backslash in server URL', () => {
+    const servers: OpenApiServerObject[] = [
+      { url: String.raw`http://api.x/\`+code+\`` },
+    ];
+    const result = getFullRoute('/path', servers, {
+      getBaseUrlFromSpecification: true,
+    });
+    expect(result).toContain(String.raw`http://api.x/\\\`+code+\\\``);
+  });
+
+  it('escapes backtick and ${ in variable default value (spec-sourced)', () => {
+    const servers: OpenApiServerObject[] = [
+      {
+        url: 'http://{env}.example.com',
+        variables: {
+          env: {
+            default:
+              '`+require("child_process").execSync("id")+`${globalThis.X}',
+          },
+        },
+      },
+    ];
+    const result = getFullRoute('/path', servers, {
+      getBaseUrlFromSpecification: true,
+    });
+    expect(result).not.toMatch(/(?<!\\)`/);
+    expect(result).not.toMatch(/(?<!\\)\$\{/);
+  });
+});
+
+describe('getRoute — spec path injection', () => {
+  it('escapes backtick in static path segment', () => {
+    const result = getRoute('/v1/`+require("child_process").execSync("id")+`');
+    expect(result).not.toMatch(/(?<!\\)`/);
+  });
+
+  it('escapes ${...} as literal text, not interpolation', () => {
+    for (const payload of [
+      '/v1/${evil}/path',
+      '/v1/${globalThis.X}/path',
+      '/v1/some${petId}/path',
+    ]) {
+      const result = getRoute(payload);
+      expect(result).not.toMatch(/(?<!\\)\$\{/);
+    }
+  });
+
+  it('preserves legitimate params after ${...} in same segment', () => {
+    for (const payload of [
+      '/v1/${evil}{petId}/path',
+      '/v1/${a}${b}{petId}/path',
+    ]) {
+      const result = getRoute(payload);
+      expect(result).toContain('${petId}');
+      expect(result).not.toMatch(/(?<!\\)\$\{(evil|[ab]\})/);
+    }
+  });
+
+  it('does not trigger guard for $ without {', () => {
+    const result = getRoute('/v1/price$/list');
+    expect(result).toContain('price$');
+  });
+
+  it('escapes backslash in static text', () => {
+    const result = getRoute('/v1/path\\to/list');
+    expect(result).toContain('path\\\\to');
+  });
+
+  it('still converts legitimate path params', () => {
+    expect(getRoute('/v1/{petId}')).toContain('${petId}');
+  });
+});
+
+describe('getRouteAsArray — single-quote injection', () => {
+  it('escapes single quote in static segment', () => {
+    const result = getRouteAsArray("v1/it's/path");
+    expect(result).toContain("it\\'s");
+  });
+
+  it('escapes single quote in non-interpolation part of mixed segment', () => {
+    const result = getRouteAsArray("pre's${petId}");
+    expect(result).toContain("pre\\'s");
+  });
+});
+
 describe('getBaseUrlRuntimeImports', () => {
   it('returns [] when baseUrl is omitted', () => {
     expect(getBaseUrlRuntimeImports()).toEqual([]);

packages/core/src/getters/route.test.ts

@@ -1,3 +1,5 @@
+import jsesc from 'jsesc';
+
 import { TEMPLATE_TAG_REGEX } from '../constants';
 import type {
   BaseUrlFromConstant,
@@ -31,9 +33,25 @@ function runtimeExpressionToUrlPrefix(expression: string): string {
 
 const hasParam = (path: string): boolean => /[^{]*{[\w*_-]*}.*/.test(path);
 
+const esc = (str: string) => jsesc(str, { quotes: 'backtick', wrap: false });
+
 const getRoutePath = (path: string): string => {
+  // Don't treat ${...} as an OpenAPI path param — the $ makes it literal text,
+  // not a {param} template. Escape the ${...} block and continue processing
+  // any legitimate {param} segments after it.
+  const braceIdx = path.indexOf('{');
+  if (braceIdx > 0 && path[braceIdx - 1] === '$') {
+    const closeIdx = path.indexOf('}', braceIdx);
+    if (closeIdx === -1) return esc(path);
+    const before = esc(path.slice(0, closeIdx + 1));
+    const rest = path.slice(closeIdx + 1);
+    return hasParam(rest)
+      ? `${before}${getRoutePath(rest)}`
+      : `${before}${esc(rest)}`;
+  }
+
   const matches = /([^{]*){?([\w*_-]*)}?(.*)/.exec(path);
-  if (!matches?.length) return path; // impossible due to regexp grouping here, but for TS
+  if (!matches?.length) return esc(path);
 
   const prev = matches[1];
   const rawParam = matches[2];
@@ -44,13 +62,18 @@ const getRoutePath = (path: string): string => {
     dash: true,
     dot: true,
   });
-  const next = hasParam(rest) ? getRoutePath(rest) : rest;
+  const next = hasParam(rest) ? getRoutePath(rest) : esc(rest);
 
   return hasParam(path)
-    ? `${prev}\${${param}}${next}`
-    : `${prev}${param}${next}`;
+    ? `${esc(prev)}\${${param}}${next}`
+    : `${esc(prev)}${param}${next}`;
 };
 
+/**
+ * Converts an OpenAPI path (`{param}`) to a template-literal route (`${param}`),
+ * escaping static segments with jsesc for safe embedding in backtick strings.
+ * The `route` arg must be a raw OpenAPI path.
+ */
 export function getRoute(route: string) {
   const splittedRoute = route.split('/');
 
@@ -60,11 +83,19 @@ export function getRoute(route: string) {
       continue;
     }
 
-    result += path.includes('{') ? `/${getRoutePath(path)}` : `/${path}`;
+    result += path.includes('{') ? `/${getRoutePath(path)}` : `/${esc(path)}`;
   }
   return result;
 }
 
+/**
+ * Prepends a base URL to an already-processed route.
+ *
+ * `route` must be the output of {@link getRoute} (already escaped for template
+ * literals). This function does NOT re-escape it — jsesc is not idempotent, so
+ * escaping twice would double the backslashes. Only the server URL from
+ * `getBaseUrlFromSpecification` is escaped here, after variable substitution.
+ */
 export function getFullRoute(
   route: string,
   servers: OpenApiServerObject[] | undefined,
@@ -92,7 +123,8 @@ export function getFullRoute(
       );
       if (!server) return '';
       const serverUrl = server.url ?? '';
-      if (!server.variables) return serverUrl;
+      if (!server.variables)
+        return jsesc(serverUrl, { quotes: 'backtick', wrap: false });
 
       let url = serverUrl;
       const variables = baseUrl.variables;
@@ -112,7 +144,7 @@ export function getFullRoute(
           url = url.replaceAll(`{${variableKey}}`, String(variable.default));
         }
       }
-      return url;
+      return jsesc(url, { quotes: 'backtick', wrap: false });
     }
     return baseUrl.baseUrl;
   };
@@ -164,15 +196,16 @@ export function getRouteAsArray(route: string): string {
     .filter((i) => i !== '')
     .flatMap((segment) => {
       if (!segment.includes('${')) {
-        return [`'${segment}'`];
+        return [`'${segment.replaceAll("'", "\\'")}'`];
       }
-      // Split by template tags, keeping the delimiters
+      // Split by template tags, keeping the delimiters.
+      // (?<!\\) prevents matching \${...} (jsesc-escaped) as a template tag.
       return segment
-        .split(/(\$\{.+?\})/g)
+        .split(/(?<!\\)(\$\{.+?\})/g)
         .filter(Boolean)
         .map((part) => {
-          const match = /^\$\{(.+?)\}$/.exec(part);
-          return match ? match[1] : `'${part}'`;
+          const match = /^(?<!\\)\$\{(.+?)\}$/.exec(part);
+          return match ? match[1] : `'${part.replaceAll("'", "\\'")}'`;
         });
     })
     .join(',');

packages/core/src/getters/route.ts

@@ -7,6 +7,7 @@ import {
   type GeneratorVerbOptions,
   GetterPropType,
   getFullRoute,
+  getRoute,
   getRouteAsArray,
   type InvalidateTarget,
   type InvalidateTargetParam,
@@ -350,7 +351,7 @@ const createGenerateInvalidateCall = (
         // prefix must carry the same `baseUrl` – otherwise the predicate /
         // partial key never matches a baseUrl-prefixed cache key. `prefix`
         // has no path params, so `getFullRoute` just concatenates the base.
-        const prefixWithBase = getFullRoute(prefix, servers, baseUrl);
+        const prefixWithBase = getFullRoute(getRoute(prefix), servers, baseUrl);
         // Mirror the verb prefix that `getQueryKeyVerbPrefix` injects into
         // non-GET Query keys; without this, the predicate / partial key
         // would never match a verb-prefixed cache key and the broad

packages/query/src/mutation-generator.ts

@@ -24,9 +24,11 @@
   },
   "dependencies": {
     "@orval/core": "workspace:*",
+    "jsesc": "^3.0.0",
     "remeda": "^2.33.6"
   },
   "devDependencies": {
+    "@types/jsesc": "^3.0.3",
     "rimraf": "catalog:",
     "typescript": "catalog:",
     "vitest": "catalog:"