Reports/*blame: properly escape file name

[jrfnl]

Description

This is a security fix for CVE-2026-67434 / GHSA-hmqg-cxww-wqhq.

Properly escape file names before calling the * blame command to prevent maliciously crafted file names from potentially running system commands.

Includes tests covering the fix for the Gitblame report.

Notes:

• While the issue could not be reproduced on Windows with the current proof of concept, the tests should still run on Windows to safeguard that the issue continues to not exist for Windows.
• Similar test(s) should be added for the Hgblame and Svnblame reports, but that will require installing those version management systems in a GitHub Actions environment and possibly initializing a system directory for Mercurial/Svn to be able to recognize the file for use with the blame command. This needs further investigation, which is outside the scope of the security fix.

Suggested changelog entry

• SECURITY FIX: Running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters. [Reports/*blame: properly escape file name #1473]
  • Users using the default Full report, or any of the other non-*blame reports, are not affected.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
  • This change is only breaking for integrators, not for external standards or end-users.
• Documentation improvement