fix: sanitize subprocess call in client.go

[orbisai0security]

Summary

Fix critical severity security issue in vendor/github.com/docker/docker-credential-helpers/client/client.go.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	vendor/github.com/docker/docker-credential-helpers/client/client.go:49

Description: The Docker credential helper client passes the serverURL value directly into cmd.Input() at client.go lines 49 and 78 using strings.NewReader(serverURL) without any sanitization or validation. The Shell helper's Input() method at command.go:52 accepts this data and feeds it to the credential helper subprocess via stdin. If the serverURL originates from user-controlled input such as a git remote URL or Docker registry configuration file, an attacker can craft a malicious serverURL containing newline characters or shell metacharacters. Depending on the underlying credential helper implementation, injected newlines may cause the helper to interpret additional lines as separate protocol messages or shell commands, potentially executing attacker-controlled operations on the host.

Changes

• vendor/github.com/docker/docker-credential-helpers/client/client.go

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security