From a85e4b23a06b593b24e2699439f4653b135d4157 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 15 Sep 2026 08:12:39 +0000
Subject: [PATCH] Fix command injection vulnerability in Windows notifications

Modified `stdlib/src/notification.rs` to securely pass dynamic string
arguments via environment variables (`$env:__TS_BODY` and `$env:__TS_TITLE`)
when spawning a PowerShell script on Windows. This eliminates the need
for naive string replacement escaping and directly addresses a critical
command injection vulnerability.

Co-authored-by: Tcode-Motion <188012755+Tcode-Motion@users.noreply.github.com>
---
 stdlib/src/notification.rs | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/stdlib/src/notification.rs b/stdlib/src/notification.rs
index a29dde0b..e7e033a9 100644
--- a/stdlib/src/notification.rs
+++ b/stdlib/src/notification.rs
@@ -34,13 +34,11 @@ impl StdlibRegistry {
                     {
                         use std::process::Command;
                         let _ = Command::new("powershell")
+                            .env("__TS_BODY", &body)
+                            .env("__TS_TITLE", &title)
                             .args([
                                 "-Command",
-                                &format!(
-                                    "[System.Windows.MessageBox]::Show('{}','{}')",
-                                    body.replace("'", "''"),
-                                    title.replace("'", "''")
-                                ),
+                                "[System.Windows.MessageBox]::Show($env:__TS_BODY, $env:__TS_TITLE)",
                             ])
                             .spawn();
                     }