Fix: Command injection vulnerability in scripts/lint.sh

Convert shell string concatenation to bash array pattern to safely handle
user-controlled arguments. This prevents shell metacharacters in the TARGET
argument from being interpreted as commands.

Changes:
- Use bash array instead of string concatenation for building command
- Expand array with "${CMD[@]}" to ensure proper quoting of each argument
- Add comments documenting the security approach

This follows the same safe pattern already applied to scripts/test.sh.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: eurunuela

claude-progress.txt

@@ -1623,6 +1623,42 @@ import { VERSION_DISPLAY } from "./constants/version";
 
 ---
 
+## Session 13 - PR Review Fixes (2026-01-10)
+
+### Goals
+- Address PR review comments about command injection vulnerabilities in shell scripts
+
+### PR Review Comments Addressed
+
+#### 1. scripts/test.sh - Command Injection (Already Fixed)
+- **Issue**: `eval $CMD` with user-controlled `TEST_FILE` argument allowed command injection
+- **Status**: Already fixed in a previous commit using bash array (`ARGS=()`) with safe expansion (`"${ARGS[@]}"`)
+
+#### 2. scripts/lint.sh - Command Injection (Fixed)
+- **Issue**: String concatenation of `CMD` with unvalidated `TARGET` argument allowed injection
+- **Fix**: Converted from string concatenation to bash array approach:
+  ```bash
+  # Before (vulnerable)
+  CMD="npx eslint"
+  CMD="$CMD --ext .js,.jsx $TARGET"
+  $CMD
+
+  # After (safe)
+  CMD=(npx eslint)
+  CMD+=("--ext" ".js,.jsx" "$TARGET")
+  "${CMD[@]}"
+  ```
+
+### Files Modified
+- `scripts/lint.sh` - Fixed command injection vulnerability using bash array
+
+### Technical Details
+- Using bash arrays prevents shell metacharacters in arguments from being interpreted
+- Array expansion with `"${CMD[@]}"` ensures each element is treated as a separate, properly-quoted argument
+- This is the standard pattern for safely building and executing commands with user input
+
+---
+
 ## Template for Future Sessions
 
 ```

scripts/lint.sh

@@ -82,27 +82,27 @@ echo ""
 echo "Target: $TARGET"
 echo ""
 
-# Build the command
-CMD="npx eslint"
+# Build the command arguments array (safe from injection)
+CMD=(npx eslint)
 
 if [ "$FIX" = true ]; then
-    CMD="$CMD --fix"
+    CMD+=("--fix")
     echo "Mode: Fix"
 else
     echo "Mode: Check only (use --fix to auto-fix)"
 fi
 
 if [ "$QUIET" = true ]; then
-    CMD="$CMD --quiet"
+    CMD+=("--quiet")
 fi
 
 # Add file extensions and target
-CMD="$CMD --ext .js,.jsx $TARGET"
+CMD+=("--ext" ".js,.jsx" "$TARGET")
 
 echo ""
 
-# Run linter
-$CMD
+# Run linter (using array expansion to safely pass arguments)
+"${CMD[@]}"
 
 LINT_EXIT=$?