From 4ba0234bd7499bb44d3d3882c33fac31874f362d Mon Sep 17 00:00:00 2001
From: Brian Majewski <brian.majewski@gmail.com>
Date: Wed, 24 Jun 2026 12:53:27 -0700
Subject: [PATCH] fix: harden recipients add --name validation (EGB-283)

Require a non-empty argument after --name (dies if it is the last token)
and reject whitespace-only labels that would write a blank comment line.
Two regression tests added to test/recipients.bats.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 secrets              |  5 ++++-
 test/recipients.bats | 16 ++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/secrets b/secrets
index 7009da4..7015a40 100755
--- a/secrets
+++ b/secrets
@@ -2106,7 +2106,7 @@ _recipients_add() {
   local key="" name=""
   while [ $# -gt 0 ]; do
     case "$1" in
-      --name) name="${2:-}"; shift 2 ;;
+      --name) [ $# -ge 2 ] || die "--name requires a value."; name="$2"; shift 2 ;;
       -*) die "Unknown flag: $1. Usage: secrets recipients add <age1...> [--name <label>]" ;;
       *) if [ -z "$key" ]; then key="$1"; else die "Unexpected argument: $1"; fi; shift ;;
     esac
@@ -2114,6 +2114,9 @@ _recipients_add() {
   [ -n "$key" ] || die "Usage: secrets recipients add <age1...> [--name <label>]"
   _validate_age_recipient "$key" || die "Not a valid age recipient: '$key' (expected age1..., 62 chars; SSH keys unsupported)."
   if [ -n "$name" ]; then
+    # Reject a whitespace-only label (would write a blank "# " comment line).
+    local _name_stripped="${name//[[:space:]]/}"
+    [ -n "$_name_stripped" ] || die "Invalid --name: must contain a non-space character."
     _validate_recipient_name "$name" || die "Invalid --name '$name' (allowed: letters, digits, space, . _ -)."
   fi
   if [ -L "$RECIPIENTS_FILE" ]; then
diff --git a/test/recipients.bats b/test/recipients.bats
index 05ff783..6c00c89 100644
--- a/test/recipients.bats
+++ b/test/recipients.bats
@@ -165,3 +165,19 @@ make_second_identity() {
   [ "$status" -ne 0 ]
   [[ "$output" == *"Invalid --name"* ]] || false
 }
+
+@test "recipients add rejects a whitespace-only --name" {
+  init_with_remote
+  make_second_identity
+  run "$SECRETS_BIN" recipients add "$BOB_PUB" --name '   '
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"Invalid --name"* ]] || false
+}
+
+@test "recipients add --name with no value errors" {
+  init_with_remote
+  make_second_identity
+  run "$SECRETS_BIN" recipients add "$BOB_PUB" --name
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"--name requires a value"* ]] || false
+}