From the 2026-08-02 full-repo review (finding F-17).
Evidence: src/targets/moose_material.cpp:353 — os << "registerMooseObject(\"" << app_name << "\", ...) with neither escape_for_cpp_literal (defined in the same file at line 101 and correctly applied to p.doc at 380 and i.role.name at 384) nor construction-time validation. This is the same class the model name was hardened against (recipe.h:311-325, whose comment explicitly calls it a malformed-output/injection vector).
Impact: a " or \ in app_name yields malformed generated C++ (loud failure today), but targets/target_factory.h:22-25 anticipates threading app_name from config/CLI, where hostile/accidental input becomes realistic.
Fix: validate app_name at construction (identifier-ish, matching the model-name precedent) or escape_for_cpp_literal at the call site; unit test with a hostile app_name.
From the 2026-08-02 full-repo review (finding F-17).
Evidence:
src/targets/moose_material.cpp:353—os << "registerMooseObject(\"" << app_name << "\", ...)with neitherescape_for_cpp_literal(defined in the same file at line 101 and correctly applied top.docat 380 andi.role.nameat 384) nor construction-time validation. This is the same class the model name was hardened against (recipe.h:311-325, whose comment explicitly calls it a malformed-output/injection vector).Impact: a
"or\inapp_nameyields malformed generated C++ (loud failure today), buttargets/target_factory.h:22-25anticipates threading app_name from config/CLI, where hostile/accidental input becomes realistic.Fix: validate app_name at construction (identifier-ish, matching the model-name precedent) or
escape_for_cpp_literalat the call site; unit test with a hostile app_name.