Fix SonarQube path injection issue in init.py

Author: amrabed

scripts/init.py

@@ -73,10 +73,9 @@ def toml_escape(s: str) -> str:
     escaped_author = toml_escape(author)
     escaped_email = toml_escape(email)
 
-    def update_file(filepath: str, file_replacements: list[tuple[str, str]]):
-        path = Path(filepath)
+    def update_file(path: Path, file_replacements: list[tuple[str, str]]):
         if not path.exists():
-            secho(f"  Warning: File {filepath} not found, skipping. ⚠️", fg="yellow")
+            secho(f"  Warning: File {path} not found, skipping. ⚠️", fg="yellow")
             return
 
         content = path.read_text()
@@ -87,18 +86,18 @@ def update_file(filepath: str, file_replacements: list[tuple[str, str]]):
 
         if new_content != content:
             path.write_text(new_content)
-            secho(f"  Updated {filepath} ✅", fg="blue")
+            secho(f"  Updated {path} ✅", fg="blue")
 
-    update_file("docs/reference/app.md", [(r"^::: project\.app", f"::: {source}.app")])
+    update_file(Path("docs/reference/app.md"), [(r"^::: project\.app", f"::: {source}.app")])
     update_file(
-        "mkdocs.yml",
+        Path("mkdocs.yml"),
         [
             (r"^repo_name: .*", f"repo_name: {github}/{name}"),
             (r"^repo_url: .*", f"repo_url: https://github.com/{github}/{name}"),
         ],
     )
     update_file(
-        "pyproject.toml",
+        Path("pyproject.toml"),
         [
             (r"^source = \[.*\]", f'source = ["{source}"]'),
             (r'^app = "project\.app:main"', f'app = "{source}.app:main"'),
@@ -107,9 +106,9 @@ def update_file(filepath: str, file_replacements: list[tuple[str, str]]):
             (r"^authors = \[.*\]", f'authors = ["{escaped_author} <{escaped_email}>"]'),
         ],
     )
-    update_file("docs/README.md", [(r"^# .*", f"# {description}")])
-    update_file(".github/CODEOWNERS", [(r"@.*", f"@{github}")])
-    update_file(".github/FUNDING.yml", [(r"^github: \[.*\]", f"github: [{github}]")])
+    update_file(Path("docs/README.md"), [(r"^# .*", f"# {description}")])
+    update_file(Path(".github/CODEOWNERS"), [(r"@.*", f"@{github}")])
+    update_file(Path(".github/FUNDING.yml"), [(r"^github: \[.*\]", f"github: [{github}]")])
 
 
 @command(context_settings={"help_option_names": ["-h", "--help"]})