From 8b019b1a84b2d9e0d0b73b151fc0250be9b5244d Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 20 Feb 2026 21:52:54 +0000
Subject: [PATCH] fix(governance): prevent argument injection in rollbackPrompt

- Validate `hashOrStrategy` to ensure it does not start with `-`.
- This prevents argument injection when falling back to `git checkout` via `execFileSync`.
- Although `execFileSync` prevents shell command injection, argument injection was still possible (e.g., `--help`).
- Verified with reproduction script.

Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
---
 src/services/governance/index.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/services/governance/index.js b/src/services/governance/index.js
index dd3290b..4d498da 100644
--- a/src/services/governance/index.js
+++ b/src/services/governance/index.js
@@ -354,6 +354,9 @@ export async function rollbackPrompt(target, hashOrStrategy = 'latest') {
   // Fallback to Git
   try {
     const commit = hashOrStrategy === 'latest' ? 'HEAD' : hashOrStrategy;
+    if (commit.startsWith('-')) {
+      throw new Error(`Invalid commit/strategy: ${commit} (cannot start with '-')`);
+    }
     execFileSync('git', ['checkout', commit, '--', target]);
     return { success: true, source: 'git', restored: commit };
   } catch (e) {