fix(security): shell-quote pip requirements instead of allowlist filtering

Replace the SAFE_REQUIREMENT_PATTERN allowlist with per-token single-quoting.
Inside single quotes /bin/sh treats every character literally, so all shell
metacharacters are neutralized while valid requirements.txt syntax (version
ranges, extras, VCS URLs, environment markers) is preserved. Also fixes a
latent bug where an unquoted `pkg>=1.0` had its `>` parsed as shell redirection.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jymaire

src/main/java/io/kestra/plugin/soda/AbstractSoda.java

@@ -8,7 +8,7 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.regex.Pattern;
+import java.util.stream.Collectors;
 
 import com.fasterxml.jackson.annotation.JsonSetter;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -44,7 +44,6 @@
 public abstract class AbstractSoda extends Task {
     private static final String DEFAULT_IMAGE = "sodadata/soda-core";
     protected static final ObjectMapper MAPPER = JacksonMapper.ofYaml();
-    private static final Pattern SAFE_REQUIREMENT_PATTERN = Pattern.compile("^[a-zA-Z0-9_\\-.\\[\\]>=<,!~ ]+$");
 
     @Schema(
         title = "Runner to use",
@@ -187,24 +186,30 @@ private String virtualEnvCommand(RunContext runContext, Path workingDirectory, L
         renderer.add("python -m venv --system-site-packages " + workingDirectory + " > /dev/null");
 
         if (requirements != null) {
-            for (String requirement : requirements) {
-                if (!SAFE_REQUIREMENT_PATTERN.matcher(requirement).matches()) {
-                    throw new IllegalArgumentException(
-                        "Invalid requirement '" + requirement + "': requirements must only contain " +
-                            "alphanumeric characters and the following symbols: _ - . [ ] > = < , ! ~ and space. " +
-                            "Shell metacharacters are not allowed."
-                    );
-                }
-            }
+            String installArgs = requirements.stream()
+                .map(AbstractSoda::shellQuote)
+                .collect(Collectors.joining(" "));
 
             renderer.addAll(
                 Arrays.asList(
                     "./bin/pip install pip --upgrade > /dev/null",
-                    "./bin/pip install " + String.join(" ", requirements) + " > /dev/null"
+                    "./bin/pip install " + installArgs + " > /dev/null"
                 )
             );
         }
 
         return String.join("\n", renderer);
     }
+
+    /**
+     * Wraps a value in single quotes for safe interpolation into a {@code /bin/sh -c} command line.
+     * Inside single quotes the shell treats every character literally, so all metacharacters
+     * ({@code ; & | > < * $ ` ( )} …) are neutralized while any valid {@code requirements.txt} syntax
+     * (version specifiers, extras, VCS URLs, environment markers) is preserved verbatim. The only
+     * character that cannot appear inside single quotes — the single quote itself — is escaped with
+     * the standard {@code '\''} sequence (close quote, escaped quote, reopen quote).
+     */
+    private static String shellQuote(String value) {
+        return "'" + value.replace("'", "'\\''") + "'";
+    }
 }