From 5106c6e9b2d624e8cd75352fb0cfd45deba18394 Mon Sep 17 00:00:00 2001
From: Andy <119136210+AndyMik90@users.noreply.github.com>
Date: Fri, 26 Dec 2025 08:53:14 +0100
Subject: [PATCH] Potential fix for code scanning alert no. 224: Uncontrolled
 command line (#285)

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 apps/frontend/scripts/download-prebuilds.cjs | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/apps/frontend/scripts/download-prebuilds.cjs b/apps/frontend/scripts/download-prebuilds.cjs
index 40d50b3f..072afcd7 100644
--- a/apps/frontend/scripts/download-prebuilds.cjs
+++ b/apps/frontend/scripts/download-prebuilds.cjs
@@ -134,10 +134,18 @@ function downloadFile(url, destPath) {
  * Extract zip file (using built-in tools)
  */
 function extractZip(zipPath, destDir) {
-  const { execSync } = require('child_process');
+  const { execFileSync } = require('child_process');
 
-  // Use PowerShell on Windows
-  execSync(`powershell -Command "Expand-Archive -Path '${zipPath}' -DestinationPath '${destDir}' -Force"`, {
+  // Use PowerShell on Windows without going through a shell
+  execFileSync('powershell', [
+    '-NoProfile',
+    '-NonInteractive',
+    '-Command',
+    'Expand-Archive',
+    '-Path', zipPath,
+    '-DestinationPath', destDir,
+    '-Force',
+  ], {
     stdio: 'inherit',
   });
 }