codegen-literal-security-scan

name	codegen-literal-security-scan
description	Detect and remediate code-generation literal injection risks in Kiota writer code (wire names, serialization names, URL templates, base URLs, defaults, and path parameter keys).

Use this skill when auditing or modifying any code generator writer logic.

Goal

Prevent generated-source injection (including potential RCE chains) by ensuring every untrusted schema-derived value is escaped for the destination literal context before being emitted.

Focus surfaces (expanded)

Prioritize all literal-emission paths under src/Kiota.Builder/Writers/**/*.cs, especially:

• WireName, SerializationName, IndexParameter.SerializationName
• UrlTemplateOverride, URI template constants, base URL defaults
• DefaultValue (constructor assignments, getter fallback values, parameter signatures)
• Path/query parameter assignment keys in convention helpers
• Query parameters mapper constants and metadata constants
• Enum wire values and enum member attributes
• Property annotations/attributes that carry serialized names
• Backing store keys for custom/additional-data properties
• Documentation long/short comments that interpolate external links/labels

Required checks

1. Locate candidate sinks:
   • search for interpolation/writes that include the focus surfaces and emit language string literals (WriteLine, WriteLines, StartBlock, doc attributes/tags).
2. Verify context-aware escaping is applied at the emission site:
   • double-quoted literal contexts must use SanitizeDoubleQuote()
   • single-quoted literal contexts must use SanitizeSingleQuote()
   • already-quoted defaults must use SanitizeQuotedStringLiteral()
   • Dart quoted literals must use SanitizeDartSingleQuoteLiteral/SanitizeDartDoubleQuoteLiteral (to also escape $)
   • Go struct tags must keep backticks and sanitize embedded quoted values (do not switch tag quoting style)
3. Confirm no fallback path emits the raw value.
4. Confirm convention-layer helpers (AddParametersAssignment and equivalents) are also sanitized, not only writer methods.

Remediation rules

• Escape at the final write site, not only upstream.
• Keep quote style unchanged and apply matching sanitizer.
• Reuse existing helpers in src/Kiota.Builder/Writers/StringExtensions.cs.
• For cross-language consistency, patch all affected writers (C#/Dart/Go/Java/PHP/Python/Ruby/TypeScript and helpers).
• Preserve runtime semantics while hardening:
  • keep Go struct tag behavior intact
  • avoid changing enum/default value resolution logic
  • avoid introducing extra quoting around non-string literals

High-risk sink families to explicitly review

1. Serializer/deserializer key emission (WireName, discriminator keys, query mapper keys).
2. Request-builder URL/template metadata (UrlTemplateOverride, URI template constants, base URL defaults).
3. Indexer/path parameter map writes (urlTplParams[...], .Add(...), .put(...), map assignments).
4. Property/enum metadata attributes and constants (QueryParameter, EnumMember, enum objects, navigation/request metadata constants).
5. Default value emission in constructors, getters, and parameter signatures.
6. Documentation comments with external links/labels and deprecation text.

Verification expectations

After changes:

1. Add/adjust regression tests in corresponding writer test suites under tests/Kiota.Builder.Tests/Writers/**.
2. Include malicious payloads with quote + newline/control characters (", ', \n, \r, \t, \\, and $ where relevant).
3. Ensure assertions validate escaped output, not just general generation success.
4. Validate targeted writer tests and then broader builder/solution validation.