Function generatePlaceholders

src/utils/bash/commands.ts:20–36

* Generates placeholder strings with random salt to prevent injection attacks. * The salt prevents malicious commands from containing literal placeholder strings * that would be replaced during parsing, allowing command argument injection. * * Security: This is critical for preventing attacks wh

()

 * `sort __SINGLE_QUOTE__ hello --help __SINGLE_QUOTE__` could inject arguments.
 */
function generatePlaceholders(): {
  SINGLE_QUOTE: string
  DOUBLE_QUOTE: string
  NEW_LINE: string
  ESCAPED_OPEN_PAREN: string
  ESCAPED_CLOSE_PAREN: string
} {
  // Generate 8 random bytes as hex (16 characters) for salt
  const salt = randomBytes(8).toString('hex')
  return {
    SINGLE_QUOTE: `__SINGLE_QUOTE_${salt}__`,
    DOUBLE_QUOTE: `__DOUBLE_QUOTE_${salt}__`,
    NEW_LINE: `__NEW_LINE_${salt}__`,
    ESCAPED_OPEN_PAREN: `__ESCAPED_OPEN_PAREN_${salt}__`,
    ESCAPED_CLOSE_PAREN: `__ESCAPED_CLOSE_PAREN_${salt}__`,
  }
}

// File descriptors for standard input/output/error
// https://en.wikipedia.org/wiki/File_descriptor#Standard_streams