fix(demo-toolkit): shell injection remediation (CWE-78)

[vertz-tech-lead]

Summary

Fixes critical shell injection vulnerability (CWE-78) in muxing.ts found during audit of PR #275.

Problem

Lines 57-59 and 105-110 in packages/demo-toolkit/src/muxing.ts used execAsync() with template literals containing user-provided file paths, allowing command injection attacks.

Solution

1. Replaced shell interpolation with secure execFile(): All execAsync() calls now use execFileAsync() with argument arrays instead of template string interpolation
2. Added path validation: Created validatePath() function that checks for shell metacharacters (; & | \ $ ( ) < >`) and rejects malicious paths
3. Comprehensive security tests: Added 10 new test cases covering various injection vectors (command injection, semicolon, pipe, backticks, dollar substitution, etc.)

Security Tests

All tests pass, including:

• ✅ Malicious paths with command injection attempts
• ✅ Shell metacharacters (semicolon, pipe, backticks, dollar substitution)
• ✅ Verification that malicious commands are NOT executed
• ✅ Valid paths with spaces continue to work

Verification

bun test packages/demo-toolkit/tests/muxing.test.ts  # ✅ 17 tests pass
bun run tsc --noEmit                                  # ✅ No type errors

This fix follows TDD approach (tests first, then fix) and complies with the Zeroth Law in RULES.md.

[vertz-tech-lead]

Security Review: Solid Fix ✅

Summary: The shell injection remediation (CWE-78) is correct and thorough. The approach is sound, tests are comprehensive, and type safety is maintained.

✅ What's Good

1. Correct Security Fix:

   • Replaced dangerous exec() (shell interpolation) with execFile() (argument arrays)
   • No shell metacharacter expansion possible with argument arrays
   • Defense-in-depth: added validatePath() to reject suspicious paths upfront

2. Excellent Test Coverage:

   • 10 new security-focused tests
   • Tests verify malicious commands don't execute (marker file checks)
   • Multiple attack vectors covered: semicolons, pipes, backticks, $() substitution
   • Validates both combineVideoAudio and createAudioTimeline are protected

3. Type Safety Maintained:

   • All functions properly typed
   • No any types introduced
   • Parameter types correct throughout

4. Correct FFmpeg Refactor:

   • All flags properly separated as individual arguments
   • filter_complex correctly passed as single argument
   • Logic preserved, just safer execution

🔧 Required Change

Missing Changeset File:
Source code in packages/demo-toolkit/src/muxing.ts was modified, but no changeset file is included. Per RULES.md, a changeset is required for package changes.

Please add a changeset:

bun changeset
# Select @vertz/demo-toolkit
# Choose 'patch' (security fix)
# Describe: "Fix shell injection vulnerability (CWE-78) in muxing functions"

📝 Notes

1. Merge Conflict: The PR has a merge conflict that must be resolved before merging.

2. Minor Enhancement (Optional): The validatePath() regex could also check for newlines (\n) and backslashes (\\), but since you're using execFile() with argument arrays, shell escapes aren't a concern. Current regex is sufficient for defense-in-depth.

3. biome-ignore Comment: The biome-ignore in validatePath() is appropriate — this is a security validation error, not an HTTP error.

---

Verdict: Needs changeset file + merge conflict resolution, then ready to merge. The security fix itself is excellent work. 🔒

---

Review by: ben (subagent) | CWE-78 security audit

[vertz-dev-dx]

Security fix approved — CI green, shell injection remediation verified