From c9c43335895fd02da7e003fc23aa2240b3eb0606 Mon Sep 17 00:00:00 2001
From: John Richmond <5629+jr@users.noreply.github.com>
Date: Mon, 29 Sep 2025 20:55:49 -0700
Subject: [PATCH] Potential fix for code scanning alert no. 189: Inefficient
 regular expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 webview-ui/src/utils/command-validation.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/webview-ui/src/utils/command-validation.ts b/webview-ui/src/utils/command-validation.ts
index 244c85c7cd..6596e4a853 100644
--- a/webview-ui/src/utils/command-validation.ts
+++ b/webview-ui/src/utils/command-validation.ts
@@ -127,7 +127,7 @@ export function containsDangerousSubstitution(source: string): boolean {
 	// Check for $"..." string interpolation with command substitution
 	// $"..." is a bash feature for translated strings that allows command substitution inside
 	// Handle escaped quotes within $"...": use (?:\\.|[^"])* to avoid premature termination on \"
-	const bashTranslatedStringWithSubstitution = /\$"(?:\\.|[^"])*(?:\$\(|`)(?:\\.|[^"])*"/.test(source)
+	const bashTranslatedStringWithSubstitution = /\$"(?:\\.|[^\\"])*(?:\$\(|`)(?:\\.|[^\\"])*"/.test(source)
 
 	// Return true if any dangerous pattern is detected
 	return (