Defect
src/cli/auth-session.ts:559 spawns cmd /c start "" <url> with url = start.verificationUriComplete ?? start.verificationUri (:229), taken verbatim from the device-auth response. cmd /c re-tokenizes its argument string even when passed as argv, so &, ^, | in the URL are interpreted. This is the only shell-interpreting spawn left in the tree; all four exec.ts spawn paths are shell: false.
Fix
Launch via rundll32.exe url.dll,FileProtocolHandler <url> or explorer.exe <url> as inert argv. Validate the scheme is http/https and the string has no control characters before dispatch. No host allowlist: verification URIs can legitimately differ in origin from the API.
Done when
Unit test: a URL containing &calc never reaches a cmd spawn. Cannot be exercised on macOS; test-only.
Defect
src/cli/auth-session.ts:559spawnscmd /c start "" <url>withurl = start.verificationUriComplete ?? start.verificationUri(:229), taken verbatim from the device-auth response.cmd /cre-tokenizes its argument string even when passed as argv, so&,^,|in the URL are interpreted. This is the only shell-interpreting spawn left in the tree; all fourexec.tsspawn paths areshell: false.Fix
Launch via
rundll32.exe url.dll,FileProtocolHandler <url>orexplorer.exe <url>as inert argv. Validate the scheme ishttp/httpsand the string has no control characters before dispatch. No host allowlist: verification URIs can legitimately differ in origin from the API.Done when
Unit test: a URL containing
&calcnever reaches acmdspawn. Cannot be exercised on macOS; test-only.