fix(security): add pathspec separator and improve path validation

- Add '--' before file pathspecs in git commands to prevent option
  injection (e.g., filename starting with '-' being interpreted as option)
  Affected commands: status, add, restore, reset

- Improve validateFilePath to use path.relative() for robust containment
  check that correctly handles edge cases like filesystem root as repo root

Author: Lukas Kraic

server/routes/git.js

@@ -23,8 +23,12 @@ function validateFilePath(rootDir, filePath) {
   const resolvedRoot = path.resolve(rootDir);
   const resolvedPath = path.resolve(rootDir, filePath);
 
-  // Ensure the resolved path starts with the root directory
-  if (!resolvedPath.startsWith(resolvedRoot + path.sep) && resolvedPath !== resolvedRoot) {
+  // Use path.relative for robust containment check that handles edge cases
+  // like filesystem root as repository root
+  const relativePath = path.relative(resolvedRoot, resolvedPath);
+
+  // Path escapes root if relative path starts with '..' or is absolute
+  if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
     throw new Error(`Invalid file path: path escapes repository root`);
   }
 
@@ -191,7 +195,7 @@ router.get('/diff', async (req, res) => {
     const gitRoot = await validateGitRepository(projectPath);
 
     // Check if file is untracked or deleted
-    const { stdout: statusOutput } = await execFileAsync('git', ['status', '--porcelain', file], { cwd: gitRoot });
+    const { stdout: statusOutput } = await execFileAsync('git', ['status', '--porcelain', '--', file], { cwd: gitRoot });
     const isUntracked = statusOutput.startsWith('??');
     const isDeleted = statusOutput.trim().startsWith('D ') || statusOutput.trim().startsWith(' D');
 
@@ -255,7 +259,7 @@ router.get('/file-with-diff', async (req, res) => {
     const gitRoot = await validateGitRepository(projectPath);
 
     // Check file status
-    const { stdout: statusOutput } = await execFileAsync('git', ['status', '--porcelain', file], { cwd: gitRoot });
+    const { stdout: statusOutput } = await execFileAsync('git', ['status', '--porcelain', '--', file], { cwd: gitRoot });
     const isUntracked = statusOutput.startsWith('??');
     const isDeleted = statusOutput.trim().startsWith('D ') || statusOutput.trim().startsWith(' D');
 
@@ -365,7 +369,7 @@ router.post('/commit', async (req, res) => {
 
     // Stage selected files
     for (const file of files) {
-      await execFileAsync('git', ['add', file], { cwd: gitRoot });
+      await execFileAsync('git', ['add', '--', file], { cwd: gitRoot });
     }
 
     // Commit with message
@@ -1090,7 +1094,7 @@ router.post('/discard', async (req, res) => {
     const gitRoot = await validateGitRepository(projectPath);
 
     // Check file status to determine correct discard command
-    const { stdout: statusOutput } = await execFileAsync('git', ['status', '--porcelain', file], { cwd: gitRoot });
+    const { stdout: statusOutput } = await execFileAsync('git', ['status', '--porcelain', '--', file], { cwd: gitRoot });
 
     if (!statusOutput.trim()) {
       return res.status(400).json({ error: 'No changes to discard for this file' });
@@ -1112,10 +1116,10 @@ router.post('/discard', async (req, res) => {
       }
     } else if (status.includes('M') || status.includes('D')) {
       // Modified or deleted file - restore from HEAD
-      await execFileAsync('git', ['restore', file], { cwd: gitRoot });
+      await execFileAsync('git', ['restore', '--', file], { cwd: gitRoot });
     } else if (status.includes('A')) {
       // Added file - unstage it
-      await execFileAsync('git', ['reset', 'HEAD', file], { cwd: gitRoot });
+      await execFileAsync('git', ['reset', 'HEAD', '--', file], { cwd: gitRoot });
     }
 
     res.json({ success: true, message: `Changes discarded for ${file}` });
@@ -1138,7 +1142,7 @@ router.post('/delete-untracked', async (req, res) => {
     const gitRoot = await validateGitRepository(projectPath);
 
     // Check if file is actually untracked
-    const { stdout: statusOutput } = await execFileAsync('git', ['status', '--porcelain', file], { cwd: gitRoot });
+    const { stdout: statusOutput } = await execFileAsync('git', ['status', '--porcelain', '--', file], { cwd: gitRoot });
 
     if (!statusOutput.trim()) {
       return res.status(400).json({ error: 'File is not untracked or does not exist' });