fix: Add input validation and improve error handling

- disk.rs: Replace unwrap() calls with proper error handling in diskutil
  parallel scanning, limit concurrent threads to 8 to prevent resource
  exhaustion on systems with many partitions
- shell.rs: Add image name validation against whitelist (alpine, freebsd-15.0)
- apk.rs: Add package name validation to prevent command injection
  (alphanumeric, dots, underscores, hyphens, plus signs, @ for repos)

Author: fenio

src-tauri/src/commands/apk.rs

@@ -1,5 +1,30 @@
 use crate::cli::execute_command;
 
+/// Validate package name to prevent command injection
+/// Package names must contain only alphanumeric characters, dots, underscores, hyphens,
+/// and optionally a version specifier like @edge
+fn validate_package_name(name: &str) -> Result<(), String> {
+    if name.is_empty() {
+        return Err("Package name cannot be empty".to_string());
+    }
+    if name.len() > 128 {
+        return Err("Package name too long".to_string());
+    }
+    // Allow: alphanumeric, dots, underscores, hyphens, plus signs (for g++ etc)
+    // Also allow @ for repository tags like package@edge
+    let valid = name.chars().all(|c| {
+        c.is_ascii_alphanumeric() || c == '.' || c == '_' || c == '-' || c == '+' || c == '@'
+    });
+    if !valid {
+        return Err(format!("Package name '{}' contains invalid characters", name));
+    }
+    // Must not start with a dash (could be interpreted as an option)
+    if name.starts_with('-') {
+        return Err("Package name cannot start with '-'".to_string());
+    }
+    Ok(())
+}
+
 #[tauri::command]
 pub fn list_packages() -> Result<Vec<String>, String> {
     let output = execute_command(&["apk", "info"], false, None)?;
@@ -19,6 +44,11 @@ pub async fn add_packages(packages: Vec<String>) -> Result<(), String> {
         return Err("No packages specified".to_string());
     }
 
+    // Validate all package names before executing
+    for pkg in &packages {
+        validate_package_name(pkg)?;
+    }
+
     tokio::task::spawn_blocking(move || {
         let mut args = vec!["apk", "add"];
         let pkg_refs: Vec<&str> = packages.iter().map(|s| s.as_str()).collect();
@@ -36,6 +66,11 @@ pub async fn remove_packages(packages: Vec<String>) -> Result<(), String> {
         return Err("No packages specified".to_string());
     }
 
+    // Validate all package names before executing
+    for pkg in &packages {
+        validate_package_name(pkg)?;
+    }
+
     tokio::task::spawn_blocking(move || {
         let mut args = vec!["apk", "del"];
         let pkg_refs: Vec<&str> = packages.iter().map(|s| s.as_str()).collect();

src-tauri/src/commands/disk.rs

@@ -239,26 +239,38 @@ fn update_filesystem_support(result: &mut DiskListResult) {
         }
     }
 
-    // Run diskutil info calls in parallel
+    // Run diskutil info calls in parallel with limited concurrency
+    // Limit to 8 concurrent threads to avoid resource exhaustion on systems with many partitions
+    const MAX_DISKUTIL_THREADS: usize = 8;
     let diskutil_results: Arc<Mutex<HashMap<String, (String, bool, Option<String>)>>> =
         Arc::new(Mutex::new(HashMap::new()));
 
-    std::thread::scope(|s| {
-        for device_id in &needs_diskutil {
-            let results = Arc::clone(&diskutil_results);
-            let device = device_id.clone();
-            s.spawn(move || {
-                if let Some(info) = get_diskutil_fs_info(&device) {
-                    results.lock().unwrap().insert(device, info);
-                }
-            });
-        }
-    });
+    // Process in batches to limit concurrency
+    for chunk in needs_diskutil.chunks(MAX_DISKUTIL_THREADS) {
+        std::thread::scope(|s| {
+            for device_id in chunk {
+                let results = Arc::clone(&diskutil_results);
+                let device = device_id.clone();
+                s.spawn(move || {
+                    if let Some(info) = get_diskutil_fs_info(&device) {
+                        // Handle mutex lock failure gracefully
+                        if let Ok(mut guard) = results.lock() {
+                            guard.insert(device, info);
+                        }
+                    }
+                });
+            }
+        });
+    }
 
-    let diskutil_map = Arc::try_unwrap(diskutil_results)
-        .unwrap()
-        .into_inner()
-        .unwrap();
+    // Extract results from Arc<Mutex<...>> safely
+    let diskutil_map = match Arc::try_unwrap(diskutil_results) {
+        Ok(mutex) => mutex.into_inner().unwrap_or_default(),
+        Err(arc) => {
+            // If other references exist (shouldn't happen), clone the inner data
+            arc.lock().map(|g| g.clone()).unwrap_or_default()
+        }
+    };
 
     // Apply results to partitions
     for disk in &mut result.disks {

src-tauri/src/commands/shell.rs

@@ -4,6 +4,23 @@ use std::sync::{Arc, Mutex};
 use tauri::{AppHandle, Emitter};
 use crate::cli::get_path;
 
+/// Valid image names for shell command
+/// This whitelist prevents potential command injection via malformed image names
+const VALID_IMAGES: &[&str] = &["alpine", "freebsd-15.0"];
+
+/// Validate image name against whitelist
+fn validate_image_name(image: &str) -> Result<(), String> {
+    if VALID_IMAGES.contains(&image) {
+        Ok(())
+    } else {
+        Err(format!(
+            "Invalid image '{}'. Valid images: {}",
+            image,
+            VALID_IMAGES.join(", ")
+        ))
+    }
+}
+
 pub struct PtyState {
     writer: Option<Box<dyn Write + Send>>,
     master: Option<Box<dyn portable_pty::MasterPty + Send>>,
@@ -41,8 +58,9 @@ pub async fn start_shell(
     let mut cmd = CommandBuilder::new(cli_path);
     cmd.arg("shell");
 
-    // Add image option if specified
+    // Add image option if specified (validated against whitelist)
     if let Some(ref img) = image {
+        validate_image_name(img)?;
         cmd.arg("-i");
         cmd.arg(img);
     }