CLI-497 wrap hook command in quotes

[sophio-japharidze-sonarsource]

---

Summary by Gitar

• Hook command quoting:
  • Wrapped hook script paths in quotes (" on Windows, ' on Unix) within resolveAgentHookCommand to support paths containing spaces or special characters.
  • Implemented quoteWindowsHookScriptPath to safely handle Windows paths in PowerShell.
  • Updated installHook in claude integration to use the new quoting logic.
• Test infrastructure:
  • Added comprehensive unit and integration tests to verify quoted paths in shell environments, including handling of embedded apostrophes and directory spaces.
  • Added unquoteHookScriptPath helper to the test harness to allow reliable verification of quoted command strings.
  • Updated legacy test expectations to account for the new quoted format.

_{This will update automatically on new commits.}

[netlify]

✅ Deploy Preview for sonarqube-cli canceled.

Name	Link
🔨 Latest commit	01aa866
🔍 Latest deploy log	https://app.netlify.com/projects/sonarqube-cli/deploys/6a4b59e62ef05f00088dbfda

[hashicorp-vault-sonar-prod]

CLI-497

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Wraps hook script paths in environment-specific quotes to support directory spaces and special characters. This change addresses the Windows meta-character vulnerability by implementing a robust quoting strategy.

✅ 1 resolved

✅ Edge Case: Windows double-quoting does not neutralize $/% metacharacters

📄 src/cli/commands/integrate/_common/hooks.ts:132-140 📄 src/cli/commands/integrate/_common/hooks.ts:202-204
quoteWindowsHookScriptPath wraps the path in double quotes, and the doc comment justifies this by noting Windows paths cannot contain a double-quote character. That correctly handles spaces, but double quotes do NOT protect against other shell metacharacters that ARE legal in Windows path segments — e.g. a folder literally named %TEMP% (expanded by cmd.exe) or $foo (expanded by PowerShell). Depending on how the agent executes the stored command string (cmd.exe vs powershell), such a path could be altered. The Unix side is fully safe because shellQuoteBash uses single quotes, but the Windows side only guarantees space-safety. This is an unlikely edge case (paths with %/$ segments are rare) and mirrors pre-existing behavior, so it is minor — but the comment overstates the safety guarantee. Consider narrowing the comment to "safe against spaces" or escaping %/backtick if the target execution shell is known.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Wraps hook command paths in OS-specific quotes to support spaces and special characters. This change resolves the previous issue with Windows metacharacter injection.

✅ 1 resolved

✅ Edge Case: Windows double-quoting does not neutralize $/% metacharacters

📄 src/cli/commands/integrate/_common/hooks.ts:132-140 📄 src/cli/commands/integrate/_common/hooks.ts:202-204
quoteWindowsHookScriptPath wraps the path in double quotes, and the doc comment justifies this by noting Windows paths cannot contain a double-quote character. That correctly handles spaces, but double quotes do NOT protect against other shell metacharacters that ARE legal in Windows path segments — e.g. a folder literally named %TEMP% (expanded by cmd.exe) or $foo (expanded by PowerShell). Depending on how the agent executes the stored command string (cmd.exe vs powershell), such a path could be altered. The Unix side is fully safe because shellQuoteBash uses single quotes, but the Windows side only guarantees space-safety. This is an unlikely edge case (paths with %/$ segments are rare) and mirrors pre-existing behavior, so it is minor — but the comment overstates the safety guarantee. Consider narrowing the comment to "safe against spaces" or escaping %/backtick if the target execution shell is known.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud