Potential fix for code scanning alert no. 1: Regular expression injection

[eschultink]

Potential fix for https://github.com/Worklytics/datastore-backup/security/code-scanning/1

To fix the issue, we need to sanitize the bucketPrefix variable before using it in the new RegExp constructor. The best way to achieve this is by using a library like lodash to escape special characters in the user-provided input. Specifically, we can use the _.escapeRegExp function to sanitize bucketPrefix before constructing the regular expression.

Changes will be made in the index.js file:

1. Import the _.escapeRegExp function from lodash.
2. Apply _.escapeRegExp to bucketPrefix before passing it to the new RegExp constructor.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR addresses a GitHub code scanning alert for regular-expression injection by escaping the GCS bucket prefix before constructing a dynamic RegExp in the backup listing output.

Changes:

• Escape bucketPrefix via _.escapeRegExp before passing it into new RegExp(...).
• Use the escaped value when stripping the prefix from gsutil ls output.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

child_process.execSync('gsutil ls ' + bucketPrefix) executes through a shell, and bucketPrefix can be influenced via the --bucketPrefix CLI option (see lib/cmd.getBackupBucket). This leaves a command-injection risk (and can also break if the bucket name contains spaces/shell metacharacters). Prefer execFileSync/spawnSync with an argv array (e.g., ['ls', bucketPrefix]) and no shell.

Suggested change

	let files = child_process.execSync('gsutil ls ' + bucketPrefix).toString('utf8');
	let files = child_process.execFileSync('gsutil', ['ls', bucketPrefix]).toString('utf8');

[aperez-worklytics]

Code is outdated with new file version, @copilot review again

[Copilot]

@aperez-worklytics I've opened a new pull request, #26, to work on those changes. Once the pull request is ready, I'll request review from you.