fix(security): remediate OS command injection in DiagnosticPing

[Copilot]

DiagnosticPing passed an unvalidated, user-controlled host query parameter directly into a shell string, enabling arbitrary OS command injection.

Changes

internal/handlers/cwe.go — DiagnosticPing

• Add host validation via safety.AllowedHostname (allowlist regex ^[a-zA-Z0-9.-]{1,253}$); reject invalid input with HTTP 400
• Replace shell invocation with fixed-argv exec — eliminates the injection vector entirely
• Return generic error to client; log command failure details server-side only

// Before — injectable
exec.Command("sh", "-c", "ping -c 1 "+host).CombinedOutput()

// After — validated + fixed argv
if !safety.AllowedHostname(host) {
    http.Error(w, "invalid host", http.StatusBadRequest)
    return
}
exec.Command("ping", "-c", "1", host).CombinedOutput()

internal/handlers/cwe.go — SafeDiagnosticPing

• Already validated and using fixed argv; no change required.

Remediation status

Rule	Status
RCH-RULE-877450ee — cmdi via shell exec	fixed
RCH-RULE-7059753c — unguarded taint→exec in DiagnosticPing	fixed
RCH-RULE-a755ac83 — unguarded taint→exec in SafeDiagnosticPing	already safe, no change