Fix command-line argument injection in Diff action (CVSS 8.6)

[jontdelorme]

Summary

Fixes a command-line argument injection vulnerability in the Diff action (DiffFileChangeAction) that let a crafted repository execute arbitrary programs on the victim's machine.

Vulnerability

git difftool was invoked with a path built by directly interpolating the file's name into the argument string, unquoted:

var args = $"difftool -y {_commitId}^ {_commitId} {path}";

ProcessStartInfo.Arguments is parsed like a shell command line. A file (or renamed-from path) named, e.g., payload --extcmd=wscript.exe would split into two arguments once whitespace-delimited: payload and --extcmd=wscript.exe. Git then parses the latter as a real --extcmd option, running an attacker-chosen program with the victim's OS privileges — triggered simply by opening the crafted repo and clicking the normal Diff button.

Fix

• Quote each path argument so a filename (including one containing spaces or leading dashes) is always treated as a single literal token.
• Insert -- before the paths so git treats everything after it as positional paths, never options — defense in depth even if quoting were somehow bypassed.
• Extracted the argument-building logic into GitHelpers.BuildDiffToolArguments (Core project) so it's unit-testable independent of the WPF UI project.

Testing

Added GitTimelapseView.Tests/GitHelpersTests.cs with regression tests, including one using the exact payload from the report (payload --extcmd=wscript.exe), asserting the malicious text always stays inside a single quoted path placed after --.

• dotnet test GitTimelapseView.Tests/GitTimelapseView.Tests.csproj → 5/5 passed
• dotnet build GitTimelapseView/GitTimelapseView.csproj → build succeeded, 0 warnings/errors

🤖 Generated with Claude Code