Validate post_type and collection titles to prevent ERB injection in generated views

[kanejamison]

Summary

Closes #60

Post type and collection titles are interpolated directly into generated ERB view code — most notably the link_to "#{title}", #{path_helper} line that bunko:add appends to the shared nav partial (lib/tasks/bunko/add.rake). A title containing ", ERB delimiters, or newlines could corrupt or inject code into the generated templates.

Per the issue, this fixes the problem at the source: Bunko::Configuration now validates titles and raises ArgumentError for titles containing:

• Double quotes (")
• ERB delimiters (<% or %>)
• Newlines or carriage returns

Implementation

• Added a private validate_title! method to Bunko::Configuration, following the existing ArgumentError style and message tone used for name validation.
• Validation runs in both #post_type and #collection, after the customizer block executes, so all three code paths are covered: auto-generated titles, title: keyword arguments, and titles set via the PostTypeCustomizer / CollectionCustomizer block form (block values override params, so validating after the block catches the final value).
• Invalid titles are rejected before the post_type/collection is registered, so a failed call leaves configuration unchanged.
• Safe titles are unaffected: apostrophes, ampersands, unicode, typographic quotes, and standalone <, >, % characters all still work.

Tests

Added test/configuration/title_validation_test.rb (26 tests) covering:

• Rejection of ", <%, %>, \n, and \r in titles — for both post_type and collection, via keyword argument and via the customizer block
• Invalid titles are not registered in configuration
• Normal titles still work (apostrophes, ampersands, unicode, typographic quotes, auto-generated titles)

Test results

• bundle exec rake (Ruby 4.0.2): 389 runs, 1389 assertions, 0 failures, 0 errors, 1 skip (skip is pre-existing)
• bundle exec standardrb: clean, exit 0

🤖 Generated with Claude Code

https://claude.ai/code/session_01CAFZmU5SJSERBVyedpsYQW

---

Generated by Claude Code