fix: harden Windows path fallbacks for clip.exe and VS Code probing

Two security comments from Copilot review:

- clipExePath returned bare 'clip.exe' when SystemRoot was unset, which re-introduces the PATH/cwd search the comment said we were avoiding. Chain SystemRoot -> WINDIR -> SystemDrive\Windows before defaulting to an absolute C:\Windows\System32\clip.exe.

- vscodeWindowsBuildInfo built tier-3 install paths by joining USERPROFILE/ProgramFiles unconditionally; when either env var was empty, filepath.Join produced a relative path (e.g. AppData\...\Code.exe) that could match a binary in the working directory. Skip tier-3 entries whose base env var is empty.

Author: dlevy-msft-sql

internal/pal/clipboard_windows.go

@@ -20,10 +20,17 @@ func copyToClipboard(text string) error {
 
 // clipExePath resolves clip.exe under %SystemRoot%\System32 so we never pick
 // up an attacker-planted clip.exe from PATH or the working directory while
-// copying the SQL password to the clipboard.
+// copying the SQL password to the clipboard. Falls back through other
+// well-known env vars before defaulting to the canonical C:\Windows path so
+// we never return a bare "clip.exe" that PATH could resolve.
 func clipExePath() string {
-	if root := os.Getenv("SystemRoot"); root != "" {
-		return filepath.Join(root, "System32", "clip.exe")
+	for _, name := range []string{"SystemRoot", "WINDIR"} {
+		if v := os.Getenv(name); v != "" {
+			return filepath.Join(v, "System32", "clip.exe")
+		}
 	}
-	return "clip.exe"
+	if drive := os.Getenv("SystemDrive"); drive != "" {
+		return filepath.Join(drive+`\`, "Windows", "System32", "clip.exe")
+	}
+	return `C:\Windows\System32\clip.exe`
 }

internal/tools/tool/vscode_windows.go

@@ -53,11 +53,16 @@ func vscodeWindowsLocations(build string) []string {
 		locations = append(locations, filepath.Join(install, exeName))
 	}
 
-	// Tier 3: standard default install directories.
-	locations = append(locations,
-		filepath.Join(userDir, exeName),
-		filepath.Join(systemDir, exeName),
-	)
+	// Tier 3: standard default install directories. Skip any whose base env
+	// var was empty -- filepath.Join with an empty base yields a relative
+	// path (e.g. AppData\...\Code.exe) that could match an unintended binary
+	// in the working directory.
+	if userDir != "" {
+		locations = append(locations, filepath.Join(userDir, exeName))
+	}
+	if systemDir != "" {
+		locations = append(locations, filepath.Join(systemDir, exeName))
+	}
 
 	return locations
 }
@@ -67,15 +72,25 @@ func vscodeWindowsBuildInfo(build string) (cliName, exeName, userDir, systemDir
 	programFiles := os.Getenv("ProgramFiles")
 
 	if build == "insiders" {
-		return "code-insiders",
-			"Code - Insiders.exe",
-			filepath.Join(userProfile, "AppData", "Local", "Programs", "Microsoft VS Code Insiders"),
-			filepath.Join(programFiles, "Microsoft VS Code Insiders")
+		cliName = "code-insiders"
+		exeName = "Code - Insiders.exe"
+		if userProfile != "" {
+			userDir = filepath.Join(userProfile, "AppData", "Local", "Programs", "Microsoft VS Code Insiders")
+		}
+		if programFiles != "" {
+			systemDir = filepath.Join(programFiles, "Microsoft VS Code Insiders")
+		}
+		return
+	}
+	cliName = "code"
+	exeName = "Code.exe"
+	if userProfile != "" {
+		userDir = filepath.Join(userProfile, "AppData", "Local", "Programs", "Microsoft VS Code")
+	}
+	if programFiles != "" {
+		systemDir = filepath.Join(programFiles, "Microsoft VS Code")
 	}
-	return "code",
-		"Code.exe",
-		filepath.Join(userProfile, "AppData", "Local", "Programs", "Microsoft VS Code"),
-		filepath.Join(programFiles, "Microsoft VS Code")
+	return
 }
 
 // vscodeRegistryInstallLocation reads InstallLocation from the Inno Setup