Merge pull request #178 from KENNYSOFT/feature/escape-pr-title

fix(fields): escape Slack control characters in pullRequest title

__tests__/fixtures/repos.commits.get.json

@@ -92,4 +92,4 @@
       "patch": "@@ -29,7 +29,7 @@\n....."
     }
   ]
-}
+}

__tests__/helper.ts

@@ -181,7 +181,7 @@ export const pullRequest = (): Field => {
   let value;
   if (context.eventName.startsWith('pull_request')) {
     value =
-      '<https://github.com/8398a7/action-slack/pull/123|Add pullRequest field #123>';
+      '<https://github.com/8398a7/action-slack/pull/123|Add pullRequest field &amp; escaping &lt;, &gt; #123>';
   } else {
     value = 'n/a';
   }

__tests__/pull_request.test.ts

@@ -67,7 +67,7 @@ describe.each`
     github.context.payload = {
       pull_request: {
         html_url: 'https://github.com/8398a7/action-slack/pull/123',
-        title: 'Add pullRequest field',
+        title: 'Add pullRequest field & escaping <, >',
         number: 123,
         head: { sha },
       },
@@ -90,7 +90,7 @@ describe.each`
     payload.attachments[0].color = 'good';
     expect(await client.prepare(msg)).toStrictEqual(payload);
     expect(process.env.AS_PULL_REQUEST).toStrictEqual(
-      '<https://github.com/8398a7/action-slack/pull/123|Add pullRequest field #123>',
+      '<https://github.com/8398a7/action-slack/pull/123|Add pullRequest field &amp; escaping &lt;, &gt; #123>',
     );
   });
 });

src/fields.ts

@@ -199,7 +199,12 @@ export class FieldFactory {
   private async pullRequest(): Promise<string> {
     let value;
     if (context.eventName.startsWith('pull_request')) {
-      value = `<${context.payload.pull_request?.html_url}|${context.payload.pull_request?.title} #${context.payload.pull_request?.number}>`;
+      value = `<${
+        context.payload.pull_request?.html_url
+      }|${context.payload.pull_request?.title
+        ?.replace(/&/g, '&amp;')
+        ?.replace(/</g, '&lt;')
+        ?.replace(/>/g, '&gt;')} #${context.payload.pull_request?.number}>`;
     } else {
       value = 'n/a';
     }