Merge pull request #198 from Tcode-Motion/security/prevent-path-traversal-process-3065281696807958351

🔒 Prevent path traversal in process commands

Author: github-actions[bot]

stdlib/src/process.rs

@@ -32,6 +32,15 @@ impl StdlibRegistry {
                         ));
                     }
                     let cmd = args[0].try_into_string()?;
+                    if cmd.contains("..") || cmd.contains('\0') {
+                        return Err(RuntimeError::new(
+                            RuntimeErrorKind::InvalidOperation(
+                                "Security policy violation: Path traversal or null bytes in command are denied".to_string(),
+                            ),
+                            None,
+                            None,
+                        ));
+                    }
                     let args_list = match &args[1] {
                         RuntimeValue::List { items, .. } => {
                             let mut list = Vec::new();
@@ -115,6 +124,16 @@ impl StdlibRegistry {
                         }
                     };
 
+                    if cmd.contains("..") || cmd.contains('\0') {
+                        return Err(RuntimeError::new(
+                            RuntimeErrorKind::InvalidOperation(
+                                "Security policy violation: Path traversal or null bytes in command are denied".to_string(),
+                            ),
+                            None,
+                            None,
+                        ));
+                    }
+
                     let parsed = shlex::split(&cmd).ok_or_else(|| {
                         RuntimeError::new(
                             RuntimeErrorKind::InvalidOperation(