From 6686c1ca937f44ca544f3e0b42b279e850154790 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 20 Aug 2026 20:13:53 +0000
Subject: [PATCH] fix(scripts): build git commands as arg arrays in
 generate-patch

The since ref from argv was interpolated into
shell command strings, flagged by CodeQL as
indirect command-line injection. execFileSync
with argument arrays removes the shell, same
treatment format-yaml got in #627.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GmHrQEQmpYthrHhmV2cB2c
---
 scripts/generate-patch.ts | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/scripts/generate-patch.ts b/scripts/generate-patch.ts
index 931f0561c..4d4165438 100644
--- a/scripts/generate-patch.ts
+++ b/scripts/generate-patch.ts
@@ -5,7 +5,7 @@
  * Run with: pnpm patch [from-version] [to-version]
  */
 
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { parse as parseYaml } from "yaml";
@@ -39,7 +39,7 @@ function buildManufacturerIdMap(): Map<string, string> {
 /** Get the nanoid of a deleted entry by reading it from git history */
 function getDeletedEntryId(since: string, filePath: string): string | null {
   try {
-    const content = execSync(`git show ${since}:${filePath}`, {
+    const content = execFileSync("git", ["show", `${since}:${filePath}`], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
     });
@@ -56,7 +56,7 @@ function getDeletedEntryId(since: string, filePath: string): string | null {
 
 function getLatestTag(): string | null {
   try {
-    return execSync("git describe --tags --abbrev=0", {
+    return execFileSync("git", ["describe", "--tags", "--abbrev=0"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
     }).trim();
@@ -70,7 +70,7 @@ function getChangedFiles(since: string): Change[] {
 
   try {
     // Get list of changed files
-    const output = execSync(`git diff --name-status ${since} HEAD -- data/`, {
+    const output = execFileSync("git", ["diff", "--name-status", since, "HEAD", "--", "data/"], {
       encoding: "utf-8",
     });