Handle substitution patterns in command validation

[mrubens]

Important

Replaces subshell detection with dangerous substitution detection in command validation to enhance security against parameter expansion vulnerabilities.

• Behavior:
  • Replaces containsSubshell with containsDangerousSubstitution in command-validation.ts to detect dangerous parameter expansions.
  • Updates getCommandDecision to prevent auto-approval for commands with dangerous substitutions.
• Tests:
  • Adds tests for containsDangerousSubstitution in command-validation.spec.ts to cover various dangerous patterns like ${var@P}, octal, hex, and unicode escapes.
  • Removes subshell detection tests and adds tests for dangerous substitution handling in getCommandDecision.
• Misc:
  • Updates comments and documentation to reflect the change from subshell detection to dangerous substitution detection.

^{This description was created by for 038ae47. You can customize this summary. It will automatically update as commits are pushed.}

[roomote]

Thank you for your contribution! I've reviewed the changes and found that the implementation correctly addresses the security vulnerability by replacing subshell detection with dangerous substitution detection. The code quality is excellent with comprehensive test coverage. I have a few suggestions for improvement.

[roomote]

Great implementation of the dangerous substitution detection! The function correctly identifies the ${var@P} vulnerability and other dangerous parameter expansions. Is it intentional that we're not checking for Unicode escape sequences like \u0060 which could also represent backticks? This might be worth considering for completeness.

[roomote]

Performance consideration: The function now checks 4 different regex patterns sequentially. While this is likely not a bottleneck, have you considered combining some patterns or short-circuiting on the most common cases first if this function is called frequently?

[roomote]

Excellent test coverage for the dangerous substitution patterns! The tests comprehensively cover the exact exploit pattern from the security report. Consider adding a test case for Unicode escape sequences (\u0060) if you decide to support them.