[plugins][security] Harden git argv against command-line injection (3 CodeQL high alerts)

[kreneskyp]

Context

CodeQL reports 3 high-severity js/second-order-command-line-injection alerts in src/resolve.ts on main. They are pre-existing in the git resolver (NOT introduced by the discovery or npm features — those are tracked separately). Source-descriptor fields (repo, url, ref, sha) flow into the git argv via execFileSync. execFileSync avoids a shell, but git itself interprets a leading-- argument as an option — e.g. a ref of --upload-pack=<cmd> or an --output=… value becomes a flag (second-order argument injection).

This is the "separate PR" agreed during review for the pre-existing git alerts.

Alert locations (src/resolve.ts)

• defaultGitRunner — execFileSync("git", args, …) (~line 20).
• git clone --filter=blob:none --no-checkout <url> … / git fetch … origin built from source.url/repo (~lines 122/128).
• git checkout --detach <wanted> where wanted = source.sha ?? source.ref ?? "HEAD" (~lines 137–138).

Tasks

• Extend the existing reqArg guard (src/sources.ts — added in feat: resolve npm sources via npm pack #3; rejects values beginning with -) to the git source fields in normalizeSource: apply to github.repo, git.url, git-subdir.url, url.url.
• Guard ref / sha against option-like values (these are not validated in normalizeSource today) — reject a leading - before they reach git checkout. (Note: git checkout -- <ref> does not accept -- cleanly before a ref, so prefer rejection over an argv separator.)
• Confirm resolveSource calls normalizeSource before any git invocation (it does — keep it that way).
• Add tests for each rejected field (repo/url/ref/sha beginning with - → SourceError).
• Add the corresponding spec constraints/ACs (mirror FR-004-CON-3) + TC rows; keep 100% coverage.
• Open as its own PR off main (do NOT fold into feat: plugin discovery (search npm/GitHub for compatible plugins) #2/feat: resolve npm sources via npm pack #3).

Acceptance criteria

• The 3 CodeQL alerts are resolved (no high second-order-command-line-injection on the branch).
• Option-like repo/url/ref/sha are rejected with SourceError (tests).
• src/** stays at 100% coverage; quire validate clean.

References

• CodeQL: agent-ix/ts-plugin-kit code-scanning alerts chore(deps): Bump actions/checkout from 4 to 6 #1/feat: plugin discovery (search npm/GitHub for compatible plugins) #2/feat: resolve npm sources via npm pack #3 (js/second-order-command-line-injection, src/resolve.ts:20 + :77).
• Precedent: reqArg + FR-004-CON-3 in feat: resolve npm sources via npm pack #3.

[kreneskyp]

Build-out complete — opened PR #8 from fix/git-argv-hardening (own branch off main, commit 533e156), per the 'own PR, don't fold into #2/#3' requirement.

• src/sources.ts: added reqArg (rejects leading -) + new optArg; in normalizeSource applied reqArg to github.repo/git.url/git-subdir.url/url.url and optArg to ref/sha on every git variant. Rejection over argv -- separator (git checkout won't take -- before a ref).
• Confirmed normalizeSource runs before any clone/fetch/checkout.
• Spec: FR-004 injection-guard Behavior note + FR-004-CON-3 + FR-004-AC-8; spec/tests.md rows + TC-022 (repo/url/ref/sha with leading -, incl. --upload-pack=… → SourceError), written Red-first.

Gates: 23 tests pass · src/** 100% coverage · eslint+prettier clean on touched files · build clean · quire validate clean. All 3 CodeQL alert sites now reached only via guarded fields.

CodeQL will re-scan on the PR to confirm the 3 high alerts clear.

[kreneskyp]

Security re-verification: PASS (merge-ready). Independent adversarial re-review confirmed both bypasses closed — the guard now validates the trimmed value (identical to what reaches the git argv via toGitUrl), and git-subdir.path is reqArg-guarded. No residual path for an option-like value to reach the git argv; 100% coverage; TC-022/023/024 green. (Out-of-scope future idea noted: a URL-scheme allowlist for file://-style transport abuse — separate from this argv-injection class.)

Now rebasing onto main (post-#3 merge) and reconciling the shared sources.ts/FR-004/tests.md edits + renumbering colliding TC/AC IDs, then it merges.

[kreneskyp]

Merged. PR #8 squash-merged to main as 44b8d0a. The 3 high CodeQL second-order-command-line-injection alerts are resolved (CodeQL results check green on the PR; no new alerts). Reconciled onto post-#3 main: unified to one trimmed reqArg guard, IDs renumbered (git → TC-029/030/031, FR-004-AC-14/15/16, CON-5), 100% coverage. Second leg of the release train done.