[Aikido] AI Fix for Potential for OS command injection via child_process call

[aikido-autofix]

This patch mitigates command injection by passing command arguments separately instead of using string concatenation.

Aikido used AI to generate this PR.

Low confidence: Aikido has tested similar fixes, which indicate the correct approach but may be incomplete. Further validation is necessary.

[cloudflare-workers-and-pages]

Deploying demo-time with    Cloudflare Pages

Latest commit:	7325c61
Status:	✅  Deploy successful!
Preview URL:	https://ab582147.demo-time.pages.dev
Branch Preview URL:	https://fix-aikido-security-sast-117.demo-time.pages.dev

View logs

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[macroscopeapp]

Replace shell command execution with child_process.execFile in ScriptExecutor.run to address OS command injection risk in the VS Code extension

Switch ScriptExecutor.run to pass a command and args array to ScriptExecutor.executeScriptAsync and import execFile; ScriptExecutor.executeScriptAsync now calls execFile but its signature and variables mismatch (command, args undefined).

📍Where to Start

Start at ScriptExecutor.run in ScriptExecutor.ts to see how the command and args are constructed, then review ScriptExecutor.executeScriptAsync in the same file to reconcile the signature and variable usage.

---

📊 Macroscope summarized 7325c61. 1 file reviewed, 2 issues evaluated, 1 issue filtered, 1 comment posted. View details

[macroscopeapp]

On Windows, execFile treats inline args as part of the executable. Appending -File to command makes it look for an exe named "powershell -File", causing ENOENT. Consider keeping command as "powershell" and putting -File in args (e.g., ["-File", scriptPath.fsPath]).

-          command = `${command} -File`;
-
-        const args = [scriptPath.fsPath];
+
+        const args = platform === 'windows' && command.toLowerCase() === 'powershell'
+          ? ['-File', scriptPath.fsPath]
+          : [scriptPath.fsPath];

🚀 Want me to fix this? Reply ex: "fix it for me".