From d4c1dce24670d4b522fe5494b3e4e855e26c7f52 Mon Sep 17 00:00:00 2001
From: Agent <agent@example.com>
Date: Thu, 25 Jun 2026 21:54:12 +0200
Subject: [PATCH] fix: use Python for description replacement to handle
 slashes/quotes/metachars (#17)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The sed-based substitution broke when repo descriptions contained '/' (very
common). Switched to Python with .replace() — handles arbitrary strings.
Also moves $REPO_DESC into 'env:' so the workflow doesn't string-interpolate
$\{\{ github.event.repository.description \}\} directly into the shell command,
closing a self-injection vector if a user's own description contained
shell metacharacters.

Closes #17.
---
 .github/workflows/template-init.yml | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/template-init.yml b/.github/workflows/template-init.yml
index 0093174..ae1710c 100644
--- a/.github/workflows/template-init.yml
+++ b/.github/workflows/template-init.yml
@@ -40,21 +40,33 @@ jobs:
           grep -lr --exclude-dir=.git 'marksverdhei' . | xargs -r sed -i "s/marksverdhei/${repo_owner}/g"
 
       - name: Replace placeholders inside files
+        env:
+          REPO_DESC: ${{ github.event.repository.description }}
         run: |
           repo_slug="${{ steps.names.outputs.repo_slug }}"
           repo_snake="${{ steps.names.outputs.repo_snake }}"
-          repo_desc="${{ github.event.repository.description }}"
 
           # replace dash-style placeholder
           grep -lr --exclude-dir=.git 'python-template' . | xargs -r sed -i "s/python-template/${repo_slug}/g"
           # replace snake_case placeholder
           grep -lr --exclude-dir=.git 'python_template' . | xargs -r sed -i "s/python_template/${repo_snake}/g"
           # replace pyproject.toml description placeholder
-          if [ -n "$repo_desc" ]; then
-            sed -i "s/Add your description here/${repo_desc}/" pyproject.toml
-          else
-            sed -i '/^description = "Add your description here"/d' pyproject.toml
-          fi
+          # Done in Python so arbitrary characters in the description (slashes,
+          # quotes, shell metachars) can't break sed parsing or shell parsing.
+          python3 - <<'PY'
+          import os, pathlib
+          path = pathlib.Path("pyproject.toml")
+          text = path.read_text()
+          desc = os.environ.get("REPO_DESC", "")
+          if desc:
+              text = text.replace("Add your description here", desc, 1)
+          else:
+              text = "\n".join(
+                  line for line in text.splitlines()
+                  if line.strip() != 'description = "Add your description here"'
+              ) + "\n"
+          path.write_text(text)
+          PY
 
       - name: Rename files and directories
         run: |