From fedc4e82ed20e84108fdc68935c9e19e9563b8c2 Mon Sep 17 00:00:00 2001
From: Dextheking1 <Dextheking1@users.noreply.github.com>
Date: Fri, 23 Oct 2026 13:27:20 +0200
Subject: [PATCH] google_workspace: use full YAML scalar escaping for shortcut
 frontmatter

(cherry picked from commit 9907005e93f28394a328530b5f08c6d43ba9c399)
---
 graphify/google_workspace.py | 36 +++++++++++++++++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

diff --git a/graphify/google_workspace.py b/graphify/google_workspace.py
index 1feeb8acd..d0d049094 100644
--- a/graphify/google_workspace.py
+++ b/graphify/google_workspace.py
@@ -29,7 +29,41 @@ def google_workspace_enabled(value: str | None = None) -> bool:
 
 
 def _safe_yaml_str(value: str) -> str:
-    return value.replace("\\", "\\\\").replace('"', '\\"').replace("\n", " ").replace("\r", " ")
+    """Escape a value for a YAML double-quoted scalar.
+
+    Same escaping as graphify.ingest._yaml_str (F-009): backslash, quote,
+    tab, NUL and other C0/DEL controls, plus the Unicode line breaks
+    U+2028, U+2029 and U+0085, so a hostile shortcut url or file id cannot
+    break out of the scalar and inject sibling frontmatter keys.
+    """
+    if value is None:
+        return ""
+    out: list[str] = []
+    for ch in str(value):
+        cp = ord(ch)
+        if ch == "\\":
+            out.append("\\\\")
+        elif ch == '"':
+            out.append('\\"')
+        elif ch == "\n":
+            out.append("\\n")
+        elif ch == "\r":
+            out.append("\\r")
+        elif ch == "\t":
+            out.append("\\t")
+        elif ch == "\0":
+            out.append("\\0")
+        elif cp == 0x2028:
+            out.append("\\L")
+        elif cp == 0x2029:
+            out.append("\\P")
+        elif cp == 0x0085:
+            out.append("\\x85")
+        elif cp < 0x20 or cp == 0x7F:
+            out.append(f"\\x{cp:02x}")
+        else:
+            out.append(ch)
+    return "".join(out)
 
 
 def _extract_file_id_from_url(url: str) -> str | None: