From abdb7a44eee6e814d5aefc24bade57b73d7645b7 Mon Sep 17 00:00:00 2001
From: Andrew Thal <467872+athal7@users.noreply.github.com>
Date: Wed, 19 Aug 2026 07:06:41 -0500
Subject: [PATCH] Potential fix for code scanning alert no. 1: Shell command
 built from environment values

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 plugin/core/devcontainer.js | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/plugin/core/devcontainer.js b/plugin/core/devcontainer.js
index e089bb5..d0312fe 100644
--- a/plugin/core/devcontainer.js
+++ b/plugin/core/devcontainer.js
@@ -673,6 +673,21 @@ export async function list(options = {}) {
   return results
 }
 
+/**
+ * Validate a value used in docker label filter expressions.
+ * Reject control characters that can alter CLI parsing semantics.
+ *
+ * @param {string} value
+ * @returns {string}
+ */
+function sanitizeDockerFilterValue(value) {
+  const normalized = String(value)
+  if (/[\0\r\n]/.test(normalized)) {
+    throw new Error('Invalid workspace value for docker filter')
+  }
+  return normalized
+}
+
 /**
  * Check if a container is running for a workspace
  * 
@@ -686,10 +701,11 @@ export async function isContainerRunning(workspace) {
   try {
     const config = await loadUserConfig()
     const dockerPath = config.dockerPath || 'docker'
+    const safeWorkspace = sanitizeDockerFilterValue(workspace)
     // Look for container with devcontainer.local_folder label
     const result = await runCommand(dockerPath, [
       'ps',
-      '--filter', `label=devcontainer.local_folder=${workspace}`,
+      '--filter', `label=devcontainer.local_folder=${safeWorkspace}`,
       '--format', '{{.ID}}',
     ])