Fix PowerShell command injection in preview command

[viperdan13]

PR Summary

Basically, the preview command was putting file paths straight into a PowerShell command. A path containing characters like ;, &, backticks, or a newline could run extra commands.

This changes the preview to use execFile with shell: false. The PowerShell command is fixed, and the paths are passed as plain environment values, so PowerShell treats them as data instead of commands.

It also adds regression tests for normal and malicious-looking paths and updates the changelog.

PR Checklist

• PR has a meaningful title
• Summarized changes
• Change is not breaking
• This PR is ready to merge and is not Work in Progress
• Code changes
  • Link to a filed issue
  • Change log has been updated with change under unreleased section

[Copilot]

🟡 Changes recommended

There are a couple of small but concrete correctness/maintainability issues in the new invocation helper and changelog formatting that should be addressed before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR mitigates PowerShell command injection risk in the PSDocs preview command by switching to an execFile-based invocation that keeps user-controlled paths out of the PowerShell command text and instead passes them via environment variables.

Changes:

• Replaces exec + interpolated PowerShell string with execFile + shell: false and a centralized invocation builder.
• Adds regression tests to ensure paths (including malicious-looking fragments) never appear in the PowerShell command text.
• Updates the changelog to note the security fix.

File summaries

File	Description
src/extension.ts	Uses execFile and delegates PowerShell invocation construction to a helper to avoid command injection.
src/psdocsInvocation.ts	Introduces a single function to build the safe pwsh -Command ... invocation with env-passed paths.
src/test/suite/psdocsInvocation.test.ts	Adds tests asserting paths never appear in the PowerShell command/args and are only passed via env.
CHANGELOG.md	Documents the security fix in the Unreleased section.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Vic Perdana (vicperdana)]

Replaced by #568, opened from the vicperdana account.