Fix command injection vulnerability in WSL certificate trust

[Copilot]

Fix command injection vulnerability in WSL certificate trust

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Fix command injection vulnerability in PowerShell command construction for WSL certificate trust

Description

The TryTrustCertificateInWindowsStore method was vulnerable to command injection through paths containing double quotes, which could break out of the -Command "..." shell string. Since certificatePath can be influenced by the DOTNET_DEV_CERTS_OPENSSL_CERTIFICATE_DIRECTORY environment variable, malicious values could execute arbitrary commands.

Changes

• Use -EncodedCommand with Base64 encoding: Encode the PowerShell script as UTF-16LE Base64 before passing to powershell.exe, eliminating command shell escaping issues
• Maintain PowerShell-level escaping: Keep single-quote escaping within the script to prevent PowerShell injection from breaking out of string literals

This provides two-layer protection: Base64 encoding prevents shell-level injection, single-quote escaping prevents PowerShell-level injection.

// Before: vulnerable to paths with double quotes
var startInfo = new ProcessStartInfo(PowerShellCommand, 
    $"-NoProfile -NonInteractive -Command \"{powershellScript}\"")

// After: Base64-encoded, immune to shell injection
var encodedCommand = Convert.ToBase64String(System.Text.Encoding.Unicode.GetBytes(powershellScript));
var startInfo = new ProcessStartInfo(PowerShellCommand, 
    $"-NoProfile -NonInteractive -EncodedCommand {encodedCommand}")

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.