From 6c22e29875883cd54a60df8818dfdd0a2d47e9a3 Mon Sep 17 00:00:00 2001
From: Alexis <alexis@eff.org>
Date: Tue, 7 Mar 2023 12:42:39 -0800
Subject: [PATCH] Update to include sanitization for JSON file

---
 .github/workflows/merged.yaml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/merged.yaml b/.github/workflows/merged.yaml
index df10cd6be..b33c901cf 100644
--- a/.github/workflows/merged.yaml
+++ b/.github/workflows/merged.yaml
@@ -18,8 +18,14 @@ jobs:
         REPO: ${{ github.repository }}
         USER: ${{ github.actor }}
         TITLE: ${{ github.event.pull_request.title }}
-      run: |
-        echo "{\"text\":\"[$REPO] | [${TITLE//\"/\\\"} #$NUMBER]($PR_URL) was merged into master by $USER.\"}" > mattermost.json
+        run: |
+          jq --null-input \
+                  --arg number "$NUMBER" \
+                  --arg pr_url "$PR_URL" \
+                  --arg repo "$REPO" \
+                  --arg user "$USER" \
+                  --arg title "$TITLE" \
+          '{ "text": "[\($repo)] | [\($title) #\($number)](\($pr_url)) was merged into master by \($user)" }' > mattermost.json
     - uses: mattermost/action-mattermost-notify@master
       env:
         MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_MERGE_WEBHOOK }}