fix(security): close CodeQL #33 go/command-injection in runGit (Critical)

[aksOps]

Alert

CodeQL alert #33 — `go/command-injection` — Critical severity, `internal/notes/history.go:106`.

Building a system command from user-controlled sources is vulnerable to insertion of malicious code by the user.

`exec.Command("git", ...)` in `runGit` received user-controlled strings: commit message bytes (author + subject), and relative paths derived from note keys. While `exec.Command` uses argv (no shell) which disables the classic shell-injection vector, git itself has flag-based attack surface that CodeQL is right to flag:

• `--upload-pack=` / `--receive-pack=` on fetch/push subcommands
• `-c core.sshCommand=` on any subcommand
• `-c core.pager= log`
• notesDir beginning with `-` would be re-parsed as a top-level flag

Fix — defense in depth

1. `runGit` gains a strict sanitiser pass:

• `notesDir` must be non-empty and must not start with `-`.
• `args[0]` must be in a closed allow-list: `init`, `config`, `add`, `log`. Any other subcommand is rejected.
• Any arg after a literal `--` must satisfy `filepath.IsLocal` (same sanitiser introduced in fix(security): filepath.IsLocal sanitisers for CodeQL path/command-injection #44 for path-injection).

2. `commit` is deliberately removed from the allow-list. Commit messages come from user input; routing them through argv was the last remaining taint flow. A new `gitCommit(notesDir, msg)` helper runs:

```
git -C commit --no-gpg-sign --allow-empty-message -F -
```

and pipes the message via stdin. User bytes never appear in argv.

3. `autoCommit` switched from `runGit(..., "commit", "-m", msg)` to `gitCommit(notesDir, msg)`.

Why this clears the alert

CodeQL's taint-tracking for `go/command-injection`:

• Recognises `filepath.IsLocal` as a sanitiser (already proven in alert history after fix(security): filepath.IsLocal sanitisers for CodeQL path/command-injection #44).
• Recognises allow-list map membership as a sanitiser for the subcommand position.
• For `gitCommit`: user data flows to `cmd.Stdin`, not `cmd.Args` — no taint into the sink.

Test results

Local: `104/104 tests passing in internal/notes/`, `go vet` clean.

Files changed

• `internal/notes/history.go` (+66 / −4)

Not addressed

Alert #11 — SAST score 9/10 (27/30 commits scanned). Cosmetic Scorecard warning. CodeQL runs on PR + push-to-main + weekly schedule — intermediate feature-branch commits aren't individually scanned. Fixing to 30/30 would require running CodeQL on every push to every branch, which is expensive for a pre-1.0 single-maintainer project. Leaving as-is.

🤖 Generated with Claude Code