Summary
Add a process execution abstraction to eliminate direct Process.Start calls and their associated command injection risks.
Changes
- ICommandRunner: interface for cross-platform command execution with argument list support
- CommandRunner: safe Process wrapper using ArgumentList (no shell parsing, no injection risk)
- CommandResult: structured result with exit code, stdout, stderr
- Migrate WindowsGeneralDrivelution PnPUtil calls to use ICommandRunner
- Migrate LinuxGeneralDrivelution insmod/modprobe/dpkg/rpm calls to use ICommandRunner
- Constructor injection: both Windows and Linux updaters accept ICommandRunner
Why
Current code concatenates arguments as strings which is vulnerable to path injection. The new approach passes each argument separately via ProcessStartInfo.ArgumentList.
Closes #288
Summary
Add a process execution abstraction to eliminate direct Process.Start calls and their associated command injection risks.
Changes
Why
Current code concatenates arguments as strings which is vulnerable to path injection. The new approach passes each argument separately via ProcessStartInfo.ArgumentList.
Closes #288