Feature: Quality gates script prevents command injection attacks
  As a security-conscious developer
  I want the quality gates script to validate all path arguments
  So that command injection attacks cannot be executed through path manipulation

  Background:
    Given the quality gates script is available
    And the project root is set correctly

  Scenario: Valid paths are accepted
    When I validate the path "src/cleveragents"
    Then the path validation should succeed
    And the validated path should be absolute

  Scenario: Empty paths are rejected
    When I validate the path ""
    Then the path validation should fail
    And the path validation error should contain "Path cannot be empty"

  Scenario: Nonexistent paths are rejected
    When I validate the path "src/cleveragents/not_a_real_path_7286"
    Then the path validation should fail
    And the path validation error should contain "Path does not exist"

  Scenario: Paths with path traversal are rejected
    When I validate the path "src/../../../etc/passwd"
    Then the path validation should fail
    And the path validation error should contain "dangerous pattern"

  @tdd_issue @tdd_issue_7286
  Scenario: Paths with semicolon are rejected
    When I validate the path "src/cleveragents;rm -rf /"
    Then the path validation should fail
    And the path validation error should contain "dangerous pattern"

  Scenario: Paths with pipe are rejected
    When I validate the path "src/cleveragents|cat /etc/passwd"
    Then the path validation should fail
    And the path validation error should contain "dangerous pattern"

  Scenario: Paths with ampersand are rejected
    When I validate the path "src/cleveragents&whoami"
    Then the path validation should fail
    And the path validation error should contain "dangerous pattern"

  Scenario: Paths with dollar sign are rejected
    When I validate the path "src/cleveragents$(whoami)"
    Then the path validation should fail
    And the path validation error should contain "dangerous pattern"

  Scenario: Paths with backticks are rejected
    When I validate the path "src/cleveragents`whoami`"
    Then the path validation should fail
    And the path validation error should contain "dangerous pattern"

  Scenario: Paths with parentheses are rejected
    When I validate the path "src/cleveragents(whoami)"
    Then the path validation should fail
    And the path validation error should contain "dangerous pattern"

  Scenario: Paths with angle brackets are rejected
    When I validate the path "src/cleveragents<file"
    Then the path validation should fail
    And the path validation error should contain "dangerous pattern"

  Scenario: Paths with newlines are rejected
    When I validate the path "src/cleveragents\nmalicious"
    Then the path validation should fail
    And the path validation error should contain "dangerous pattern"

  Scenario: Security check uses validated paths
    When I run the security check
    Then the subprocess should not be called with shell=True
    And all path arguments should be validated

  Scenario: Dead code check uses validated paths
    When I run the dead code check
    Then the subprocess should not be called with shell=True
    And all path arguments should be validated

  Scenario: Complexity check uses validated paths
    When I run the complexity check
    Then the subprocess should not be called with shell=True
    And all path arguments should be validated