fix(security): remediate OS command injection in DiagnosticPing (CWE-78)

[Copilot]

DiagnosticPing concatenated a request-controlled host parameter directly into a shell command string, enabling arbitrary command execution via the /diagnostics/ping endpoint.

Changes

internal/handlers/cwe.go

• DiagnosticPing: replaced shell-interpolated invocation with validated fixed-argv exec:

// Before (vulnerable)
out, err := exec.Command("sh", "-c", "ping -c 1 "+host).CombinedOutput()

// After
if !safety.AllowedHostname(host) {
    http.Error(w, "invalid host", http.StatusBadRequest)
    return
}
out, err := exec.Command("ping", "-c", "1", host).CombinedOutput()
if err != nil {
    log.Printf("ping %s: %v: %s", host, err, out)
    http.Error(w, "ping failed", http.StatusBadGateway)
    return
}

• SafeDiagnosticPing: already guarded with AllowedHostname + fixed argv — no change required.

Remediation units

Rule	Status
RCH-RULE-877450ee — cmdi via shell exec	fixed
RCH-RULE-7059753c — unguarded http_param→code_exec in DiagnosticPing	fixed
RCH-RULE-a755ac83 — unguarded http_param→code_exec in SafeDiagnosticPing	already safe, no change