fix(software): stop shelling the 7-Zip uninstall string through cmd

The NanaZip swap read 7-Zip's QuietUninstallString from HKLM and interpolated it
straight into cmd /c, executing registry-sourced text as admin. Parse it with
Get-AtlasParsedUninstallString (accepting only the documented "<quoted exe>" [args]
shape) and launch the executable directly; an unrecognized string logs a warning
and keeps the existing 7-Zip install rather than running anything.

Author: jacksyrm

playbook/Executables/AtlasModules/Scripts/Modules/Atlas.Software/Domain/Installers.ps1

@@ -311,6 +311,25 @@ function Install-AtlasNanaZip {
     }
 }
 
+function Get-AtlasParsedUninstallString {
+    # Parse a registry QuietUninstallString into an executable + argument string
+    # WITHOUT ever handing it to a shell. Accept only the documented 7-Zip shape:
+    # "<quoted exe path>" [args]. Anything unquoted or otherwise malformed (which
+    # includes metacharacter-bearing strings like `C:\x.exe & calc`) returns $null
+    # so callers can decline safely rather than execute registry-sourced text.
+    param([Parameter(Mandatory = $true)][string]$UninstallString)
+
+    if ($UninstallString -match '^"([^"]+)"\s*(.*)$') {
+        $uninstallArgs = if ($Matches[2]) { $Matches[2] } else { '/S' }
+        return @{
+            FilePath     = $Matches[1]
+            ArgumentList = $uninstallArgs
+        }
+    }
+
+    return $null
+}
+
 function Install-AtlasArchiveTool {
     param([Parameter(Mandatory = $true)][string]$TempDir)
 
@@ -334,7 +353,15 @@ NanaZip is a fork of 7-Zip with an updated user interface and extra features.
             if ((Read-MessageBox -Title 'Installing NanaZip - Atlas' -Body $message -Icon Question) -eq 'Yes') {
                 $sevenZipUninstall = (Get-ItemProperty -Path $sevenZipRegistry -Name 'QuietUninstallString' -ErrorAction SilentlyContinue).QuietUninstallString
                 if ($sevenZipUninstall) {
-                    Start-AtlasSoftwareInstaller -FilePath 'cmd.exe' -ArgumentList ("/c $sevenZipUninstall") -Description '7-Zip removal'
+                    # QuietUninstallString is machine-writable data; never feed it to a shell.
+                    $parsedUninstall = Get-AtlasParsedUninstallString -UninstallString $sevenZipUninstall
+                    if ($parsedUninstall) {
+                        Start-AtlasSoftwareInstaller -FilePath $parsedUninstall.FilePath -ArgumentList $parsedUninstall.ArgumentList -Description '7-Zip removal'
+                    }
+                    else {
+                        Write-AtlasLog -Level Warning -Message "Unrecognized 7-Zip QuietUninstallString format; keeping the existing 7-Zip installation."
+                        return
+                    }
                 }
                 Install-AtlasNanaZip -TempDir $TempDir -Assets $assets
             }

tests/Atlas.Software.Tests.ps1

@@ -399,3 +399,41 @@ Describe 'Install-AtlasArchiveTool asset selection' {
         }
     }
 }
+
+Describe 'the 7-Zip uninstall-string parser' {
+    # Get-AtlasParsedUninstallString accepts only the documented, quoted 7-Zip shape
+    # and never hands registry-sourced text to a shell; it is module-private, hence
+    # InModuleScope.
+
+    It 'parses a quoted exe path with trailing arguments' {
+        InModuleScope Atlas.Software {
+            $parsed = Get-AtlasParsedUninstallString -UninstallString '"C:\Program Files\7-Zip\Uninstall.exe" /S'
+
+            $parsed | Should -Not -BeNullOrEmpty
+            $parsed.FilePath | Should -Be 'C:\Program Files\7-Zip\Uninstall.exe'
+            $parsed.ArgumentList | Should -Be '/S'
+        }
+    }
+
+    It 'defaults the arguments to /S when only a quoted path is present' {
+        InModuleScope Atlas.Software {
+            $parsed = Get-AtlasParsedUninstallString -UninstallString '"C:\Program Files\7-Zip\Uninstall.exe"'
+
+            $parsed | Should -Not -BeNullOrEmpty
+            $parsed.FilePath | Should -Be 'C:\Program Files\7-Zip\Uninstall.exe'
+            $parsed.ArgumentList | Should -Be '/S'
+        }
+    }
+
+    It 'rejects an unquoted, metacharacter-bearing string' {
+        InModuleScope Atlas.Software {
+            Get-AtlasParsedUninstallString -UninstallString 'C:\x.exe & calc' | Should -BeNullOrEmpty
+        }
+    }
+
+    It 'rejects an empty-quotes-free string' {
+        InModuleScope Atlas.Software {
+            Get-AtlasParsedUninstallString -UninstallString 'C:\Program Files\7-Zip\Uninstall.exe /S' | Should -BeNullOrEmpty
+        }
+    }
+}