claude-code - ✅(Solved) Fix Bug: Unescaped regex metacharacters in frontmatter parser sed command [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#52406Fetched 2026-04-24 06:08:01
View on GitHub
Comments
0
Participants
1
Timeline
3
Reactions
0
Author
Participants
Timeline (top)
labeled ×2cross-referenced ×1

In plugins/plugin-dev/skills/plugin-settings/scripts/parse-frontmatter.sh (line 51), field names are interpolated directly into a sed regex pattern without escaping special characters. If a field name contains regex metacharacters (., *, ?, [, ], etc.), the sed command will fail or match incorrectly.

Root Cause

In plugins/plugin-dev/skills/plugin-settings/scripts/parse-frontmatter.sh (line 51), field names are interpolated directly into a sed regex pattern without escaping special characters. If a field name contains regex metacharacters (., *, ?, [, ], etc.), the sed command will fail or match incorrectly.

Fix Action

Fixed

PR fix notes

PR #52416: fix: escape regex metacharacters in frontmatter field names

Description (problem / solution / changelog)

Summary

  • Escape regex metacharacters in field names before using them in sed patterns in parse-frontmatter.sh and validate-settings.sh
  • Without escaping, a field like my.setting would match myXsetting since . is a regex wildcard

Test plan

  • Test with normal field names (enabled, strict_mode) still works
  • Test with a field name containing . (e.g. my.setting) matches only the exact field

Fixes #52406

🤖 Generated with Claude Code

Changed files

  • plugins/plugin-dev/skills/plugin-settings/scripts/parse-frontmatter.sh (modified, +3/-1)
  • plugins/plugin-dev/skills/plugin-settings/scripts/validate-settings.sh (modified, +3/-1)

Code Example

VALUE=$(echo "$FRONTMATTER" | grep "^${FIELD}:" | sed "s/${FIELD}: *//" | ...)

---

ESCAPED_FIELD=$(printf '%s\n' "$FIELD" | sed -e 's/[]\/$*.^[]/\\&/g')
VALUE=$(echo "$FRONTMATTER" | grep "^${FIELD}:" | sed "s/${ESCAPED_FIELD}: *//" | ...)
RAW_BUFFERClick to expand / collapse

Description

In plugins/plugin-dev/skills/plugin-settings/scripts/parse-frontmatter.sh (line 51), field names are interpolated directly into a sed regex pattern without escaping special characters. If a field name contains regex metacharacters (., *, ?, [, ], etc.), the sed command will fail or match incorrectly.

Steps to Reproduce

  1. Have a frontmatter field with a name containing regex metacharacters, e.g. my.setting
  2. The sed pattern becomes s/my.setting: *//
  3. . matches any character, so myXsetting: value would also match

Code

VALUE=$(echo "$FRONTMATTER" | grep "^${FIELD}:" | sed "s/${FIELD}: *//" | ...)

Expected Behavior

Field names should be escaped before being used in sed regex patterns.

Suggested Fix

Escape the field name before interpolation:

ESCAPED_FIELD=$(printf '%s\n' "$FIELD" | sed -e 's/[]\/$*.^[]/\\&/g')
VALUE=$(echo "$FRONTMATTER" | grep "^${FIELD}:" | sed "s/${ESCAPED_FIELD}: *//" | ...)

Note

The same issue exists in plugins/plugin-dev/skills/plugin-settings/scripts/validate-settings.sh (line 77).

extent analysis

TL;DR

Escape field names before interpolating them into sed regex patterns to prevent incorrect matches.

Guidance

  • Identify all occurrences of field name interpolation in sed patterns and apply escaping to prevent regex metacharacter issues.
  • Use the suggested fix as a template to escape field names: ESCAPED_FIELD=$(printf '%s\n' "$FIELD" | sed -e 's/[]\/$*.^[]/\\&/g').
  • Review plugins/plugin-dev/skills/plugin-settings/scripts/validate-settings.sh (line 77) for the same issue and apply the fix.
  • Test the changes with field names containing regex metacharacters to verify correct behavior.

Example

The provided suggested fix code snippet demonstrates how to escape field names:

ESCAPED_FIELD=$(printf '%s\n' "$FIELD" | sed -e 's/[]\/$*.^[]/\\&/g')
VALUE=$(echo "$FRONTMATTER" | grep "^${FIELD}:" | sed "s/${ESCAPED_FIELD}: *//" | ...)

Notes

This fix assumes that the field names do not contain newline characters, as the printf and sed commands are designed to handle single-line input.

Recommendation

Apply the workaround by escaping field names before interpolation, as it directly addresses the identified issue and prevents incorrect sed pattern matches.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING