From a32a01a435fbe2d2f45b7a2fa18b7de71189990c Mon Sep 17 00:00:00 2001
From: Rootless-Ghost/RG-Nebula
 <139057350+Rootless-Ghost@users.noreply.github.com>
Date: Mon, 13 Apr 2026 10:46:00 -0400
Subject: [PATCH] Potential fix for code scanning alert no. 9: Uncontrolled
 command line

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 core/event_collector.py | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/core/event_collector.py b/core/event_collector.py
index 2df9c85..9d68ede 100644
--- a/core/event_collector.py
+++ b/core/event_collector.py
@@ -108,6 +108,16 @@ def _query_wel(
 ) -> list[dict]:
     """Run the PowerShell collection script and return parsed raw events."""
     try:
+        # Normalize and validate subprocess-bound inputs.
+        try:
+            parsed_start = datetime.fromisoformat(start_time_iso.replace("Z", "+00:00"))
+            safe_start_time_iso = parsed_start.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
+        except Exception:
+            safe_start_time_iso = datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+        safe_max_per_channel = max(1, min(int(max_per_channel), 1000))
+        safe_timeout = max(1, min(int(timeout), 300))
+
         # Defense in depth: enforce allowlist again at command-construction boundary.
         allowed = set(DEFAULT_LOG_SOURCES)
         safe_log_sources = [src for src in log_sources if src in allowed]
@@ -126,18 +136,18 @@ def _query_wel(
             "-File",
             script_path,
             "-StartTime",
-            start_time_iso,
+            safe_start_time_iso,
             "-LogNamesJson",
             log_names_json,
             "-MaxPerLog",
-            str(max_per_channel),
+            str(safe_max_per_channel),
         ]
         try:
             proc = subprocess.run(
                 ps_args,
                 capture_output=True,
                 text=True,
-                timeout=timeout,
+                timeout=safe_timeout,
             )
         finally:
             try: