Fix JSDoc comment security vulnerability: remove flawed escaping check

src/code-gen-process.ts

@@ -223,6 +223,8 @@ export class CodeGenProcess {
         Ts: this.config.Ts,
         formatDescription:
           this.schemaParserFabric.schemaFormatters.formatDescription,
+        escapeJSDocContent:
+          this.schemaParserFabric.schemaFormatters.escapeJSDocContent,
         internalCase: internalCase,
         classNameCase: pascalCase,
         pascalCase: pascalCase,

src/schema-parser/schema-formatters.ts

@@ -102,18 +102,30 @@ export class SchemaFormatters {
     return formatterFn?.(parsedSchema) || parsedSchema;
   };
 
+  escapeJSDocContent = (content) => {
+    if (!content) return "";
+    // Escape */ sequences to prevent breaking out of JSDoc comments
+    // Escape /* sequences to prevent creating nested comments
+    return content
+      .replace(/\*\//g, "*\\/")
+      .replace(/\/\*/g, "\\/*");
+  };
+
   formatDescription = (description, inline) => {
     if (!description) return "";
 
-    const hasMultipleLines = description.includes("\n");
+    // First escape JSDoc comment characters
+    const escapedDescription = this.escapeJSDocContent(description);
+
+    const hasMultipleLines = escapedDescription.includes("\n");
 
-    if (!hasMultipleLines) return description;
+    if (!hasMultipleLines) return escapedDescription;
 
     if (inline) {
       return (
         lodash
           // @ts-expect-error TS(2339) FIXME: Property '_' does not exist on type 'LoDashStatic'... Remove this comment to see the full error message
-          ._(description)
+          ._(escapedDescription)
           .split(/\n/g)
           .map((part) => part.trim())
           .compact()
@@ -122,7 +134,7 @@ export class SchemaFormatters {
       );
     }
 
-    return description.replace(/\n$/g, "");
+    return escapedDescription.replace(/\n$/g, "");
   };
 
   formatObjectContent = (content) => {

templates/base/object-field-jsdoc.ejs

@@ -1,18 +1,18 @@
 <%
 const { field, utils } = it;
-const { formatDescription, require, _ } = utils;
+const { formatDescription, escapeJSDocContent, require, _ } = utils;
 
 const comments = _.uniq(
     _.compact([
-        field.title,
+        field.title && escapeJSDocContent(field.title),
         field.description,
         field.deprecated && ` * @deprecated`,
         !_.isUndefined(field.format) && `@format ${field.format}`,
         !_.isUndefined(field.minimum) && `@min ${field.minimum}`,
         !_.isUndefined(field.maximum) && `@max ${field.maximum}`,
-        !_.isUndefined(field.pattern) && `@pattern ${field.pattern}`,
+        !_.isUndefined(field.pattern) && `@pattern ${escapeJSDocContent(field.pattern)}`,
         !_.isUndefined(field.example) &&
-        `@example ${_.isObject(field.example) ? JSON.stringify(field.example) : field.example}`,
+        `@example ${_.isObject(field.example) ? JSON.stringify(field.example) : escapeJSDocContent(field.example)}`,
     ]).reduce((acc, comment) => [...acc, ...comment.split(/\n/g)], []),
 );
 %>

templates/base/route-docs.ejs

@@ -1,6 +1,6 @@
 <%
 const { config, route, utils } = it;
-const { _, formatDescription, fmtToJSDocLine, pascalCase, require } = utils;
+const { _, formatDescription, escapeJSDocContent, fmtToJSDocLine, pascalCase, require } = utils;
 const { raw, request, routeName } = route;
 
 const jsDocDescription = raw.description ?
@@ -9,7 +9,7 @@ const jsDocDescription = raw.description ?
 const jsDocLines = _.compact([
     _.size(raw.tags) && ` * @tags ${raw.tags.join(", ")}`,
     ` * @name ${pascalCase(routeName.usage)}`,
-    raw.summary && ` * @summary ${raw.summary}`,
+    raw.summary && ` * @summary ${escapeJSDocContent(raw.summary)}`,
     ` * @request ${_.upperCase(request.method)}:${raw.route}`,
     raw.deprecated && ` * @deprecated`,
     routeName.duplicate && ` * @originalName ${routeName.original}`,
@@ -18,7 +18,7 @@ const jsDocLines = _.compact([
     ...(config.generateResponses && raw.responsesTypes.length
     ? raw.responsesTypes.map(
         ({ type, status, description, isSuccess }) =>
-            ` * @response \`${status}\` \`${_.replace(_.replace(type, /\/\*/g, "\\*"), /\*\//g, "*\\")}\` ${description}`,
+            ` * @response \`${status}\` \`${_.replace(_.replace(type, /\/\*/g, "\\*"), /\*\//g, "*\\")}\` ${escapeJSDocContent(description)}`,
         )
     : []),
 ]).map(str => str.trimEnd()).join("\n");

tests/__snapshots__/extended.test.ts.snap

@@ -27686,7 +27686,7 @@ export interface SecretScanningUpdateAlertPayload {
 export interface SelectedActions {
   /** Whether GitHub-owned actions are allowed. For example, this includes the actions in the \`actions\` organization. */
   github_owned_allowed: boolean;
-  /** Specifies a list of string-matching patterns to allow specific action(s). Wildcards, tags, and SHAs are allowed. For example, \`monalisa/octocat@*\`, \`monalisa/octocat@v2\`, \`monalisa/*\`." */
+  /** Specifies a list of string-matching patterns to allow specific action(s). Wildcards, tags, and SHAs are allowed. For example, \`monalisa/octocat@*\`, \`monalisa/octocat@v2\`, \`monalisa\\/*\`." */
   patterns_allowed: string[];
   /** Whether actions in GitHub Marketplace from verified creators are allowed. Set to \`true\` to allow all GitHub Marketplace actions by verified creators. */
   verified_allowed: boolean;

tests/__snapshots__/simple.test.ts.snap

@@ -15493,7 +15493,7 @@ export enum SecretScanningAlertState {
 export interface SelectedActions {
   /** Whether GitHub-owned actions are allowed. For example, this includes the actions in the \`actions\` organization. */
   github_owned_allowed: boolean;
-  /** Specifies a list of string-matching patterns to allow specific action(s). Wildcards, tags, and SHAs are allowed. For example, \`monalisa/octocat@*\`, \`monalisa/octocat@v2\`, \`monalisa/*\`." */
+  /** Specifies a list of string-matching patterns to allow specific action(s). Wildcards, tags, and SHAs are allowed. For example, \`monalisa/octocat@*\`, \`monalisa/octocat@v2\`, \`monalisa\\/*\`." */
   patterns_allowed: string[];
   /** Whether actions in GitHub Marketplace from verified creators are allowed. Set to \`true\` to allow all GitHub Marketplace actions by verified creators. */
   verified_allowed: boolean;