affaan-m/everything-claude-code:docs/ja-JP/skills/cpp-testing

The `CMakeLists.txt` snippet demonstrates fetching external content using `FetchContent_Declare` with a URL that includes a variable `${GTEST_VERSION}`. While `GTEST_VERSION` is hardcoded to `v1.17.0` in this example, the accompanying comment `# プロジェクトポリシーに合わせて調整します。` (adjust according to project policy) suggests it is intended to be configurable. If an AI agent allows untrusted user input to define `GTEST_VERSION` without strict validation and sanitization, a malicious string containing shell metacharacters could be injected into the URL. If the underlying `FetchContent` mechanism uses a shell command (e.g., `curl` or `wget`) to fetch the URL and does not properly escape the URL string, this could lead to arbitrary command execution on the host system. This also presents a supply chain risk if a malicious version or URL is injected.