From 52ef13fa1b68e5b56145754dd9bcf1f26e034497 Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Mon, 14 Sep 2026 09:42:10 +0000
Subject: [PATCH] harden: sanitize child_process call in preflight.js

Detected calls to child_process from a function argument `codexBin`
Addresses javascript.lang.security.detect-child-process.detect-child-process
---
 src/preflight.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/preflight.js b/src/preflight.js
index c45b524..702834d 100644
--- a/src/preflight.js
+++ b/src/preflight.js
@@ -73,9 +73,15 @@ function runCodexVersionProbe(codexBin) {
     candidates = [codexBin];
   }
 
+  const hasShellMetacharacters = value => /[;&|`$()<>^"'\n\r]/.test(value);
+
   for (const candidate of candidates) {
     const extension = path.extname(candidate).toLowerCase();
-    const result = process.platform === 'win32' && (extension === '.cmd' || extension === '.bat')
+    const useShell = process.platform === 'win32' && (extension === '.cmd' || extension === '.bat');
+    if (useShell && hasShellMetacharacters(candidate)) {
+      continue;
+    }
+    const result = useShell
       ? spawnSync(candidate, ['--version'], {
         shell: true,
         encoding: 'utf8',