Fix shell injection vulnerability and address PR feedback

- Replace string concatenation with exec.CommandContext using separate arguments in all DefaultsCommand methods (Read, ReadType, Write, WriteWithType)
- This prevents shell injection by passing values as distinct arguments instead of embedding them in command strings
- Update push_type_test.go to handle new error message format from direct exec calls
- Remove todo.txt file as suggested in PR feedback

Security improvements:
- All command execution now uses exec.CommandContext(ctx, command, arg1, arg2, ...)
- Values are no longer interpolated into shell command strings
- Eliminates risk of shell injection from special characters in domain, key, or value parameters

Co-Authored-By: k \u201C\u713C\u914E\u304A\u6E6F\u5272\u308A250ml 30%\u5F15\u304D\u201D <fumiya.kume@hotmail.com>

Author: devin-ai-integration[bot]

internal/defaults/defaults_command.go

@@ -44,8 +44,7 @@ func (d *DefaultsCommandImpl) Read(ctx context.Context) (string, error) {
 	if d.domain == "" || d.key == "" {
 		return "", fmt.Errorf("domain and key cannot be empty")
 	}
-	command := fmt.Sprintf("defaults read %s %s", d.domain, d.key)
-	output, err := exec.CommandContext(ctx, "bash", "-c", command).Output()
+	output, err := exec.CommandContext(ctx, "defaults", "read", d.domain, d.key).Output()
 	if err != nil {
 		return "", err
 	}
@@ -57,8 +56,7 @@ func (d *DefaultsCommandImpl) ReadType(ctx context.Context) (string, error) {
 	if d.domain == "" || d.key == "" {
 		return "", fmt.Errorf("domain and key cannot be empty")
 	}
-	command := fmt.Sprintf("defaults read-type %s %s", d.domain, d.key)
-	output, err := exec.CommandContext(ctx, "bash", "-c", command).Output()
+	output, err := exec.CommandContext(ctx, "defaults", "read-type", d.domain, d.key).Output()
 	if err != nil {
 		return "string", nil
 	}
@@ -77,8 +75,7 @@ func (d *DefaultsCommandImpl) Write(ctx context.Context, value string) error {
 	if d.domain == "" || d.key == "" {
 		return fmt.Errorf("domain and key cannot be empty")
 	}
-	command := fmt.Sprintf("defaults write %s %s %s", d.domain, d.key, value)
-	_, err := exec.CommandContext(ctx, "bash", "-c", command).Output()
+	_, err := exec.CommandContext(ctx, "defaults", "write", d.domain, d.key, value).Output()
 	if err != nil {
 		return err
 	}
@@ -91,14 +88,14 @@ func (d *DefaultsCommandImpl) WriteWithType(ctx context.Context, value string, v
 	}
 
 	typeFlag := mapInternalTypeToFlag(valueType)
-	var command string
+	var args []string
 	if typeFlag == "" || valueType == "string" {
-		command = fmt.Sprintf("defaults write %s %s %s", d.domain, d.key, value)
+		args = []string{"defaults", "write", d.domain, d.key, value}
 	} else {
-		command = fmt.Sprintf("defaults write %s %s %s %s", d.domain, d.key, typeFlag, value)
+		args = []string{"defaults", "write", d.domain, d.key, typeFlag, value}
 	}
 
-	_, err := exec.CommandContext(ctx, "bash", "-c", command).Output()
+	_, err := exec.CommandContext(ctx, args[0], args[1:]...).Output()
 	if err != nil {
 		return err
 	}

internal/operation/push/push_type_test.go

@@ -25,7 +25,7 @@ func TestPushWithTypes(t *testing.T) {
 	Push(configs)
 
 	logStr := logOutput.String()
-	if strings.Contains(logStr, "Failed to write") && !strings.Contains(logStr, "exit status 127") {
+	if strings.Contains(logStr, "Failed to write") && !strings.Contains(logStr, "exit status 127") && !strings.Contains(logStr, "executable file not found") {
 		t.Errorf("Unexpected error in log output: %s", logStr)
 	}
 }
@@ -43,7 +43,7 @@ func TestPushWithStringType(t *testing.T) {
 	Push(configs)
 
 	logStr := logOutput.String()
-	if strings.Contains(logStr, "Failed to write") && !strings.Contains(logStr, "exit status 127") {
+	if strings.Contains(logStr, "Failed to write") && !strings.Contains(logStr, "exit status 127") && !strings.Contains(logStr, "executable file not found") {
 		t.Errorf("Unexpected error in log output: %s", logStr)
 	}
 }
@@ -61,7 +61,7 @@ func TestPushWithEmptyType(t *testing.T) {
 	Push(configs)
 
 	logStr := logOutput.String()
-	if strings.Contains(logStr, "Failed to write") && !strings.Contains(logStr, "exit status 127") {
+	if strings.Contains(logStr, "Failed to write") && !strings.Contains(logStr, "exit status 127") && !strings.Contains(logStr, "executable file not found") {
 		t.Errorf("Unexpected error in log output: %s", logStr)
 	}
 }