fix(controller): validate ADB shell commands to close arbitrary-shell (S4)

[luisguzman-adfa]

Summary

Phase 1 (security hardening). IIABAdbManager.executeCommand ran openStream("shell:" + command) — an on-device shell over ADB — with no validation. Today's callers pass fixed commands, but the method accepts any string, so a value with shell metacharacters (; | & $ ( ) < >, backticks, quotes, newlines) could chain or substitute extra commands run with ADB privileges. Tech-debt item S4.

Changes

• adb/domain/AdbShellCommand (new, pure JVM): isSafe(command) rejects shell control / substitution / redirection / quote characters and control chars, so only a single self-contained command can run. Unit-tested (AdbShellCommandTest).
• IIABAdbManager.executeCommand: validates and fails closed (logs + does not open the shell: stream) on an unsafe command. The two legitimate settings put global … / device_config put … calls are unaffected.

Design note (per discussion)

We chose metacharacter rejection over an exact command allowlist: ADB commands legitimately grow with new features, so an allowlist would be brittle, whereas rejecting ; | & $ \ ( ) < > ' " \+ CR/LF/control neutralizes command-chaining/substitution while allowing any normal single command. The othershell: calls in the class (top, settings get, dumpsys`) are fixed literals and were not the vector.

Testing

AdbShellCommandTest (pure JVM, CI testDebugUnitTest gate): accepts the two real app commands; rejects chaining, substitution, redirection, quotes/escape, newlines, empty/null. Logic also verified out of band (16 cases).

With S4 done, the only remaining Phase 1 item is F15 (cleartext OTA APK).

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}