From bf15b0ebb4d0c6c17abb87d2b51c14aa9a9a05d1 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 24 Aug 2026 09:57:04 +0100
Subject: [PATCH] chore(security): triage and resolve panic-attack findings
 (fixes #14)

---
 rescript-templater/init-raczotbuild.rkt | 6 +++---
 rescript-templater/tests/bash-tests.sh  | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/rescript-templater/init-raczotbuild.rkt b/rescript-templater/init-raczotbuild.rkt
index 964253d..9a0f95c 100644
--- a/rescript-templater/init-raczotbuild.rkt
+++ b/rescript-templater/init-raczotbuild.rkt
@@ -214,9 +214,9 @@
      (when (do-gitinit?)
        (printf "\nInitializing git repository...\n")
        (parameterize ([current-directory (proj-name)])
-         (system "git init .")
-         (system "git add .")
-         (system (format "git commit -m \"chore: init ~a\"" (proj-name)))))
+         (system* (find-executable-path "git") "init")
+         (system* (find-executable-path "git") "add" ".")
+         (system* (find-executable-path "git") "commit" "-m" (format "chore: init ~a" (proj-name)))))
 
      (printf "\n🎉 Done! Your Zotero plugin project is ready.\n")
      (printf "   cd ~a && start developing!\n" (proj-name))]))
diff --git a/rescript-templater/tests/bash-tests.sh b/rescript-templater/tests/bash-tests.sh
index fd42e3a..bc00b55 100755
--- a/rescript-templater/tests/bash-tests.sh
+++ b/rescript-templater/tests/bash-tests.sh
@@ -88,7 +88,7 @@ assert_command_succeeds() {
   local message="${2:-Command should succeed}"
 
   ((TESTS_RUN++))
-  if eval "$cmd" > /dev/null 2>&1; then
+  if bash -c "$cmd" > /dev/null 2>&1; then
     echo -e "${GREEN}✓${NC} $message"
     ((TESTS_PASSED++))
   else
@@ -102,7 +102,7 @@ assert_command_fails() {
   local message="${2:-Command should fail}"
 
   ((TESTS_RUN++))
-  if ! eval "$cmd" > /dev/null 2>&1; then
+  if ! bash -c "$cmd" > /dev/null 2>&1; then
     echo -e "${GREEN}✓${NC} $message"
     ((TESTS_PASSED++))
   else