Fix PowerShell command injection in preview command

[Vic Perdana (vicperdana)]

PR Summary

Basically, the preview command was putting file paths straight into a PowerShell command. A path containing characters like ;, &, backticks, or a newline could run extra commands.

This changes the preview to use execFile with shell: false. The PowerShell command is fixed, and the paths are passed as plain environment values, so PowerShell treats them as data instead of commands.

It also adds regression tests for normal and malicious-looking paths and updates the changelog.

PR Checklist

• PR has a meaningful title
• Summarized changes
• Change is not breaking
• This PR is ready to merge and is not Work in Progress
• Code changes
  • Link to a filed issue
  • Change log has been updated with change under unreleased section

[Copilot]

Copilot review overview

🟡 Changes recommended

The new path.join behavior can allow absolute paths and .. traversal (potentially writing outside the template folder) and should be validated before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Lite
Findings: 1 · 2

New issues introduced by this change (3)

Severity	Finding
	src/​extension.ts — outputPath is prompted as a relative path, but path.join(templateFolderPath, outputPath) will…
	CHANGELOG.md — The Unreleased section mixes a bulleted entry with a non-bulleted line. For consistent changelog…
	src/​psdocsInvocation.ts — PSDOCS_COMMAND hard-codes the environment variable names as strings. Since you already export…

What changed in this PR

Hardens the PSDocs preview command execution path by removing PowerShell command-string interpolation of user-controlled paths and switching to a safer execFile invocation with shell: false, passing paths via environment variables.

Changes:

• Replaces exec + shell: "pwsh" with execFile("pwsh", ["-Command", ...], { shell: false, env: ... }) using a centralized invocation builder.
• Adds regression tests ensuring path values (including malicious-looking fragments) never appear in the PowerShell command text.
• Updates the changelog with a security fix entry.

File	Description
src/​extension.ts	Switches preview execution to execFile and uses the new invocation helper.
src/​psdocsInvocation.ts	Introduces a helper to build a safe PowerShell invocation using env vars.
src/​test/​suite/​psdocsInvocation.test.ts	Adds tests asserting paths are passed via env and not embedded in command text.
CHANGELOG.md	Notes the command injection fix in the Unreleased section.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Elinora White (ElinoraWhite)]

Vic Perdana (@vicperdana) All good to merge