WindowsCommandValidator

Command validator for Windows systems.

Validation Order:

• Extract executable from command (remove quotes, handle paths with spaces, remove path, remove extensions, convert to lowercase)

• If no whitelist configured → allow (backward compatible)

• Check for multiple command separators → reject if found

• Check relative path safety (commands starting with .\ or ./) → reject if escapes current directory

• Check whitelist (case-insensitive) → reject if not in whitelist

Multiple Command Detection: Detects Windows-specific separators: &, &&, |, ||, newline (ignores separators within quotes or after escape ^)

Note: Semicolon (;) is NOT a separator in Windows cmd.exe

Executable Extraction:

• Handles quoted commands (double quotes)

• Handles paths with spaces (e.g., C:\Program Files\app.exe)

• Extracts command name without path (handles both \ and /)

• Removes extensions: .exe, .bat, .cmd (case-insensitive)

• Converts result to lowercase for consistent matching