Skip to content
Sarj Code Standards

slack-event-text-in-mrkdwn

Keep proven event-controlled text out of Slack markup controls.

SARJ316 Rule source Tests Catalog JSON

Why

JSON quoting does not neutralize Slack markup controls in pull-request titles or branch names.

Fix

Use plain_text for event-controlled text, or deliberately encode reserved Slack controls before combining it with trusted markup.

Examples

Before — flagged A PR title reaches Slack markup unchanged
.github/workflows/notify.yml
name: Notify
on: pull_request
jobs:
  notify:
    runs-on: ubuntu-latest
    steps:
      - id: payload
        env:
          TITLE: ${{ github.event.pull_request.title }}
        run: bash scripts/slack_payload.sh
      - uses: slackapi/slack-github-action@v4
        with:
          webhook-type: incoming-webhook
          webhook: ${{ secrets.SLACK_WEBHOOK }}
          payload: ${{ steps.payload.outputs.payload }}
scripts/slack_payload.sh
#!/usr/bin/env bash
payload=$(jq -nc --arg title "$TITLE" '{blocks: [{type: "section", text: {type: "mrkdwn", text: $title}}]}')
printf 'payload=%s\n' "$payload" >> "$GITHUB_OUTPUT"
After — preferred A PR title remains plain text
.github/workflows/notify.yml
name: Notify
on: pull_request
jobs:
  notify:
    runs-on: ubuntu-latest
    steps:
      - id: payload
        env:
          TITLE: ${{ github.event.pull_request.title }}
        run: bash scripts/slack_payload.sh
      - uses: slackapi/slack-github-action@v4
        with:
          webhook-type: incoming-webhook
          webhook: ${{ secrets.SLACK_WEBHOOK }}
          payload: ${{ steps.payload.outputs.payload }}
scripts/slack_payload.sh
#!/usr/bin/env bash
payload=$(jq -nc --arg title "$TITLE" '{blocks: [{type: "section", text: {type: "plain_text", text: $title}}]}')
printf 'payload=%s\n' "$payload" >> "$GITHUB_OUTPUT"

Files

**/*.yml**/*.yaml