From e2b975f27e5cc218c18cda599d8c8b3abe39c1bb Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Mon, 10 Aug 2026 12:22:28 +0000
Subject: [PATCH] harden: sanitize child_process call in cli.js

Detected calls to child_process from a function argument `cmd`
Addresses javascript.lang.security.detect-child-process.detect-child-process
---
 bin/cli.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/bin/cli.js b/bin/cli.js
index e1d726c..f3bacea 100644
--- a/bin/cli.js
+++ b/bin/cli.js
@@ -203,6 +203,10 @@ function run(cmd, cwd) {
 
 // ---- ensure-worktree — 确保变更的隔离 worktree 已创建 ----
 function runEnsureWorktree(name, cwd) {
+    if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
+        console.error(t('  ✗ 无效的变更名（仅允许字母、数字、- 和 _）', '  ✗ Invalid name (only alphanumeric, - and _ are allowed)'));
+        process.exit(1);
+    }
     const worktreeDir = path.join(cwd, '.worktrees', name);
 
     if (fs.existsSync(worktreeDir)) {