Fix shell injection vulnerability in /resolve-review command

[Copilot]

The gh pr create command used unvalidated, unquoted branch name variables, allowing potential command injection via malicious branch names (e.g., bugfix; rm -rf /).

Changes:

• Added case-based validation restricting branch names to [A-Za-z0-9._/-]
• Quoted all branch name variable references in shell commands ("$VAR" vs <VAR>)
• Added error handling that exits on validation failure

Example:

# Before (vulnerable)
gh pr create --base <ORIGINAL_PR_HEAD_BRANCH> --head <FIX_BRANCH_NAME> ...

# After (protected)
case "$ORIGINAL_PR_HEAD_BRANCH" in
  (*[!A-Za-z0-9._/-]*|'')
    echo "Error: ORIGINAL_PR_HEAD_BRANCH contains unsafe characters: $ORIGINAL_PR_HEAD_BRANCH" >&2
    exit 1
    ;;
esac

gh pr create --base "$ORIGINAL_PR_HEAD_BRANCH" --head "$FIX_BRANCH_NAME" ...

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.