fix: prevent command injection via shell metacharacters on Windows

[VenkatKwest]

Description

This PR fixes command injection vulnerabilities on Windows in two files:

1. executor.ts (git spawn)

• Removed shell: true — git is a native .exe and doesn't need it
• Switched from spawn(\git ${args.join(' ')}`)tospawn('git', args)`
• Separated -m flag from commit message: ['commit', '-m', message] instead of ['commit', \-m "${message}"`]`

2. host.ts (package manager spawn)

• Package managers (npm/yarn/pnpm) are .cmd scripts on Windows and need a shell
• Instead of using shell: true with unsanitized argument concatenation, we now invoke cmd.exe /d /s /c directly with properly escaped arguments
• Escape logic is based on cross-spawn's battle-tested approach, inlined to avoid adding a dependency
• Uses windowsVerbatimArguments: true to prevent Node.js from re-escaping

Testing

Verified on Windows 11 (Node v25.6.0):

• npm/git commands work correctly with the new approach
• Injection payloads (& echo INJECTED, & echo PWNED > file) are blocked
• Old shell: true pattern confirmed vulnerable (control test)

Fixes #32509

[gemini-code-assist]

Code Review

This pull request addresses command injection vulnerabilities on Windows by removing shell: true where it's not needed and by properly escaping arguments when a shell is required.

The changes in packages/angular_devkit/schematics/tasks/repo-init/executor.ts for git commands are correct, switching to spawn with an argument array instead of a concatenated string.

The changes in packages/angular/cli/src/package-managers/host.ts for package manager commands correctly identify the need for a shell on Windows but replace the insecure shell: true with a direct call to cmd.exe. However, I've found an issue in the custom argument escaping logic. The regular expressions for escaping backslashes are different from the cross-spawn library they are based on, and one of them appears to be buggy, which could lead to incorrect escaping. I've left a comment with a suggested fix to align the implementation with cross-spawn's battle-tested approach.

_{Note: Security Review is unavailable for this PR.}

[alan-agius4]

This seems redundant since the input is a string.

Suggested change

	// Convert to string
	arg = `${arg}`;

[alan-agius4]

The below code is literally a copy and paste from cross-spawn. Please add links or re-write and mention that is was inspires from. Otherwise this cannot be merged.

[alan-agius4]

I had a chat with @clydin and actually this is not a vulnerability at all as the commit message cannot be passed via the command line and thus command injection cannot be triggered in this case.

Hence, kindly revert all the changes host.ts, can leave the cleanup in the executor.ts

[VenkatKwest]

Thanks for the review, @alan-agius4! I've addressed all your feedback:

1. **Removed the redundant arg = \${arg}`** — since the parameter is already typed as string`.
2. Added proper attribution with source links — the docblock now clearly states it's adapted from cross-spawn's lib/util/escape.js and links to the authoritative Microsoft documentation for the escaping algorithm it uses.
3. Refactored to avoid multiple re-assignments — using a chained .replace() approach as you suggested.