Init

[motdotla]

No description provided.

[superagent-security]

Superagent found 1 security concern(s).

[superagent-security]

P1: The Git clean filter interpolates the filename into a shell command without escaping it

The filter command leaves Git's %f filename substitution unquoted, enabling shell metacharacter command injection during git add.

Pass the filename through an argv-safe wrapper; add a malicious-filename regression test before installing this filter.

AI prompt

Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.

<file name="src/lib/helpers/installPrecommitFilter.js">
<violation number="1" location="src/lib/helpers/installPrecommitFilter.js:37">
<priority>P1</priority>
<title>The Git clean filter interpolates the filename into a shell command without escaping it</title>
<evidence>The installed filter command is assembled as `${executable} precommit --clean %f`. Git substitutes `%f` with the path being staged, and the path is left unquoted or otherwise argv-escaped. A repository file with shell metacharacters in its name can therefore alter the filter command and execute unintended commands when a user runs git add.</evidence>
<recommendation>Do not interpolate `%f` into a shell command. Install an argv-safe wrapper that receives the filename without shell parsing, or use a fixed executable/command interface that safely passes the path; add a regression test with shell metacharacters in a staged filename.</recommendation>
</violation>
</file>

[motdotla]

false positive. added a regression test to demonstrate.

[superagent-security]

False-positive claims on a P1 command-injection finding require a clear technical explanation (e.g., Git invokes the filter via exec/argv without shell interpretation) and confirmation that the regression test exercises shell-sensitive metacharacters (e.g. ;, |, $(…), backticks). Please provide that context or a pointer to the test logic so reviewers can verify the claim before dismissing.