🔒 Security: fix command injection via project_name (Windows shell=True)

[shunfeng8421]

Summary

Fix command injection vulnerability in WindowsExecutor._build_windows_command().

Vulnerability

project_name originates from the MCP deploy_compose tool argument and is interpolated directly into a shell command string without quoting:

# Before (vulnerable)
f'-p {self.project_name} {command} {" ".join(args)}'

On Windows, this command is executed via create_subprocess_shell(cmd, shell=True). An attacker-controlled project_name such as test && calc.exe results in arbitrary command execution.

Affected

• Windows only — the Linux path (_build_unix_command) passes arguments as a list and is not affected

Fix

import shlex
f'-p {shlex.quote(self.project_name)} {shlex.quote(command)} {" ".join(map(shlex.quote, args))}'

shlex.quote() properly escapes shell metacharacters on both Windows and POSIX.

Entry point

MCP client → deploy_compose(project_name="evil && cmd") 
  → handlers.py:73 → DockerComposeExecutor 
  → _build_windows_command → create_subprocess_shell(shell=True)