audit-labs/gh-attest

GitHub Audit Evidence Extractor

clone: git clone https://gitbay.org/audit-labs/gh-attest.git

161b13ad7d5981a6811cd9e6ae1f4390828c5a39

verified · cmc

author: Christian Cleberg <hello@cleberg.net> · 2026-07-20T16:03:43Z

Narrow esc() to primitives (S6551)

esc() accepted `unknown`, so an object passed by mistake would be
stringified as "[object Object]" and rendered straight into an evidence
table — a silent data-quality bug in exactly the place it matters least
to have one.

Narrowing the parameter to `string | number | null | undefined` makes
that a compile error instead of a runtime surprise. Every existing call
site already passes a primitive, so type checking is unchanged and the
bundle is byte-identical.

Escaping behaviour verified unchanged: the five HTML-significant
characters are still neutralised, and null/undefined still render empty.

 src/dashboard.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/dashboard.ts b/src/dashboard.ts
index f45b7bf..7848d8d 100644
--- a/src/dashboard.ts
+++ b/src/dashboard.ts
@@ -47,7 +47,10 @@ export interface DashboardData {
   lastPolledAt: string | null;
 }
 
-function esc(value: unknown): string {
+// Deliberately narrower than `unknown`: an object reaching here would render
+// as "[object Object]" in an evidence table, which is worse than failing.
+// Keeping the parameter to primitives makes that a compile error instead.
+function esc(value: string | number | null | undefined): string {
   return String(value ?? "").replace(/[&<>"']/g, (c) => {
     switch (c) {
       case "&": return "&amp;";