Replace shell-based git execution with execFile to avoid command injection

- Refactor `apps/editor/src/features/checkpoints/utils/git-utils.ts` to prevent shell injection by replacing `child_process.exec` with `child_process.execFile`, updating `exec_async` to accept a signature of `(command: string, args: string[], options: any)`, and rewriting all git commands in the file to pass arguments safely as an array (specifically changing the untracked files diff to pass `['diff', '--no-index', '--binary', '--', '/dev/null', file]`).
- [Pasted text]

└── apps
    └── editor
        └── src
            ├── commands
            │   ├── apply-response-command
            │   │   ├── apply-response-command.ts
            │   │   ├── response-processor
            │   │   │   └── handlers
            │   │   │       ├── fast-replace-handler.ts
            │   │   │       ├── search-replace-handler.ts
            │   │   │       └── truncated-handler.ts
            │   │   └── utils
            │   │       └── file-operations
            │   │           └── create-file-if-needed.ts
            │   └── history-command
            │       └── actions
            │           ├── create-temporary-checkpoint.ts
            │           └── restore-checkpoint.ts
            ├── features
            │   └── checkpoints
            │       ├── actions
            │       │   └── create-checkpoint.ts
            │       └── utils
            │           ├── git-utils.ts
            │           └── index.ts
            └── utils
                └── path-sanitizer.ts

Author: robertpiosik

apps/editor/src/commands/history-command/actions/restore-checkpoint.ts

@@ -1,4 +1,4 @@
-import { execSync } from 'child_process'
+import { execFileSync } from 'child_process'
 import * as os from 'os'
 import * as path from 'path'
 import * as vscode from 'vscode'
@@ -182,11 +182,11 @@ export const restore_checkpoint = async (params: {
                 current_git_info.commit_hash == git_info.commit_hash
               ) {
                 try {
-                  execSync(`git restore .`, {
+                  execFileSync('git', ['restore', '.'], {
                     cwd: folder.uri.fsPath,
                     stdio: 'pipe'
                   })
-                  execSync(`git clean -fd`, {
+                  execFileSync('git', ['clean', '-fd'], {
                     cwd: folder.uri.fsPath,
                     stdio: 'pipe'
                   })
@@ -197,11 +197,11 @@ export const restore_checkpoint = async (params: {
                     data: error
                   })
                   try {
-                    execSync(`git checkout .`, {
+                    execFileSync('git', ['checkout', '.'], {
                       cwd: folder.uri.fsPath,
                       stdio: 'pipe'
                     })
-                    execSync(`git clean -fd`, {
+                    execFileSync('git', ['clean', '-fd'], {
                       cwd: folder.uri.fsPath,
                       stdio: 'pipe'
                     })
@@ -245,17 +245,24 @@ export const restore_checkpoint = async (params: {
                     Buffer.from(diff, 'utf8')
                   )
                   try {
-                    execSync(
-                      `git apply --whitespace=nowarn "${temp_diff_path}"`,
+                    execFileSync(
+                      'git',
+                      ['apply', '--whitespace=nowarn', temp_diff_path],
                       {
                         cwd: folder.uri.fsPath,
                         stdio: 'pipe'
                       }
                     )
                   } catch (e) {
                     try {
-                      execSync(
-                        `git apply --reject --whitespace=nowarn "${temp_diff_path}"`,
+                      execFileSync(
+                        'git',
+                        [
+                          'apply',
+                          '--reject',
+                          '--whitespace=nowarn',
+                          temp_diff_path
+                        ],
                         {
                           cwd: folder.uri.fsPath,
                           stdio: 'pipe'
@@ -308,13 +315,13 @@ export const restore_checkpoint = async (params: {
                   GIT_WORK_TREE: temp_git_clone_path
                 }
 
-                execSync(`git read-tree "${git_info.commit_hash}"`, {
+                execFileSync('git', ['read-tree', git_info.commit_hash], {
                   cwd: folder.uri.fsPath,
                   env: git_env,
                   stdio: 'pipe'
                 })
 
-                execSync(`git checkout-index -a -f`, {
+                execFileSync('git', ['checkout-index', '-a', '-f'], {
                   cwd: folder.uri.fsPath,
                   env: git_env,
                   stdio: 'pipe'
@@ -343,17 +350,24 @@ export const restore_checkpoint = async (params: {
                     Buffer.from(diff, 'utf8')
                   )
                   try {
-                    execSync(
-                      `git apply --whitespace=nowarn "${temp_diff_path}"`,
+                    execFileSync(
+                      'git',
+                      ['apply', '--whitespace=nowarn', temp_diff_path],
                       {
                         cwd: temp_git_clone_path,
                         stdio: 'pipe'
                       }
                     )
                   } catch (e) {
                     try {
-                      execSync(
-                        `git apply --reject --whitespace=nowarn "${temp_diff_path}"`,
+                      execFileSync(
+                        'git',
+                        [
+                          'apply',
+                          '--reject',
+                          '--whitespace=nowarn',
+                          temp_diff_path
+                        ],
                         {
                           cwd: temp_git_clone_path,
                           stdio: 'pipe'

apps/editor/src/features/checkpoints/utils/git-utils.ts

@@ -1,10 +1,14 @@
 import * as vscode from 'vscode'
-import { exec } from 'child_process'
+import { execFile } from 'child_process'
 import { Logger } from '@shared/utils/logger'
 
-const exec_async = (command: string, options: any): Promise<string> => {
+const exec_async = (
+  command: string,
+  args: string[],
+  options: any
+): Promise<string> => {
   return new Promise((resolve, reject) => {
-    exec(command, options, (error, stdout, stderr) => {
+    execFile(command, args, options, (error, stdout, stderr) => {
       if (error) {
         ;(error as any).stdout = stdout
         ;(error as any).stderr = stderr
@@ -28,14 +32,14 @@ export const get_git_info = async (
 ): Promise<GitInfo | null> => {
   try {
     const branch = (
-      await exec_async('git rev-parse --abbrev-ref HEAD', {
+      await exec_async('git', ['rev-parse', '--abbrev-ref', 'HEAD'], {
         cwd: workspace_folder.uri.fsPath,
         encoding: 'utf8'
       })
     ).trim()
 
     const commit_hash = (
-      await exec_async('git rev-parse HEAD', {
+      await exec_async('git', ['rev-parse', 'HEAD'], {
         cwd: workspace_folder.uri.fsPath,
         encoding: 'utf8'
       })
@@ -60,11 +64,15 @@ export const get_git_diff = async (
     let total_diff = ''
 
     try {
-      const tracked_diff = await exec_async('git diff --binary HEAD', {
-        cwd,
-        encoding: 'utf8',
-        maxBuffer: 50 * 1024 * 1024
-      })
+      const tracked_diff = await exec_async(
+        'git',
+        ['diff', '--binary', 'HEAD'],
+        {
+          cwd,
+          encoding: 'utf8',
+          maxBuffer: 50 * 1024 * 1024
+        }
+      )
       if (tracked_diff) {
         total_diff += tracked_diff
       }
@@ -77,7 +85,8 @@ export const get_git_diff = async (
     }
 
     const untracked_files_output = await exec_async(
-      'git ls-files -z --others --exclude-standard',
+      'git',
+      ['ls-files', '-z', '--others', '--exclude-standard'],
       {
         cwd,
         encoding: 'utf8',
@@ -90,12 +99,15 @@ export const get_git_diff = async (
 
     const process_untracked_file = async (file: string) => {
       try {
-        const cmd = `git diff --no-index --binary /dev/null "${file}"`
-        const diff_chunk = await exec_async(cmd, {
-          cwd,
-          encoding: 'utf8',
-          maxBuffer: 50 * 1024 * 1024
-        })
+        const diff_chunk = await exec_async(
+          'git',
+          ['diff', '--no-index', '--binary', '--', '/dev/null', file],
+          {
+            cwd,
+            encoding: 'utf8',
+            maxBuffer: 50 * 1024 * 1024
+          }
+        )
         return diff_chunk
       } catch (err) {
         if ((err as any).status === 1 && (err as any).stdout) {
@@ -137,7 +149,7 @@ export const is_git_repository = async (
   workspace_folder: vscode.WorkspaceFolder
 ): Promise<boolean> => {
   try {
-    await exec_async('git rev-parse --git-dir', {
+    await exec_async('git', ['rev-parse', '--git-dir'], {
       cwd: workspace_folder.uri.fsPath
     })
     return true