From ec5d1326b4cee2d0d8f6b0a7848260009a162734 Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Sat, 22 Aug 2026 18:13:46 +0000
Subject: [PATCH] harden: sanitize child_process call in prepare-native.js

Detected calls to child_process from a function argument `command`
Addresses javascript.lang.security.detect-child-process.detect-child-process
---
 packages/claude-code/lib/prepare-native.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/packages/claude-code/lib/prepare-native.js b/packages/claude-code/lib/prepare-native.js
index efbcf74..db23f2a 100755
--- a/packages/claude-code/lib/prepare-native.js
+++ b/packages/claude-code/lib/prepare-native.js
@@ -76,6 +76,9 @@ function fetchNativeTarball(spec, packDir) {
     if (!tarballUrl) {
       throw new Error(`npm view did not return dist.tarball for ${spec}`);
     }
+    if (!/^https:\/\//.test(tarballUrl)) {
+      throw new Error(`Unexpected tarball URL scheme for ${spec}`);
+    }
     run('curl', [
       '--fail',
       '--location',
@@ -83,6 +86,7 @@ function fetchNativeTarball(spec, packDir) {
       '--connect-timeout', String(curlConnectTimeout),
       '--max-time', String(curlMaxTime),
       '--output', directTarball,
+      '--',
       tarballUrl,
     ]);
     if (fs.existsSync(directTarball)) {