(via ryandens): Fix shell injection vulnerability in JavaagentAwareStartScriptGenerator

[macroscopeapp]

Summary

Fixes a shell injection vulnerability in JavaagentAwareStartScriptGenerator.Fake.write() by adding platform-aware shell escaping for javaagent option strings.

Changes

Added proper escaping for agent option values to prevent malicious input from being interpreted as shell commands:

• Unix scripts: Option values are wrapped in single quotes with internal single quotes escaped as '\''
• Windows scripts: % characters are doubled to %% to prevent environment variable expansion

Security Impact

Previously, unescaped option strings passed to the javaagent could potentially be exploited to execute arbitrary shell commands. This fix ensures that special characters in option values are properly escaped for the target platform's shell interpreter.

Note

Macroscope: Fix It For Me

• This PR originated from this comment in Add ability to pass options to javaagents (#50) #379.
• Since auto-merge is on, Macroscope will merge this PR after waiting for checks to pass.
• If you'd rather not wait, you can always merge this yourself but no further action from you is currently needed.
• You can also @mention Macroscope in this PR to request further changes.

Activity

Currently: Auto-merged 2ae86eb

Previously

• Waiting on checks
• Pushed 51d4603
• Action failed: Validate
• Waiting on checks
• Pushed a62e381

---

Note

Fix shell injection vulnerability in JavaagentAwareStartScriptGenerator by escaping option values

• On Unix, javaagent option values are wrapped in single quotes with internal single quotes escaped to prevent shell injection.
• On Windows, percent signs in option values are doubled to prevent variable expansion.
• The Writer now accepts a platform argument to apply the correct escaping strategy per OS.
• Behavioral Change: generated start scripts now quote javaagent option values, which changes the output format of DEFAULT_JVM_OPTS on Unix.

^{Macroscope summarized 51d4603.}