🔒 fix argument injection vulnerability in speedtest server parameter

Validates that the user-provided `--speedtest-server` parameter does not start with a hyphen (`-`) before passing it to `asyncio.create_subprocess_exec` in `tier_ookla`. This prevents option injection vulnerabilities where a malicious user or external script could supply flags (e.g. `--hacked`) that the `speedtest` binary would process. Also adds a test case to prevent regression.

Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com>

src/netsleuth/speed.py

@@ -124,6 +124,9 @@ async def tier_ookla(
     iface_name: str | None = None,
     ipv4: str | None = None,
 ) -> SpeedResult:
+    if server and server.startswith("-"):
+        raise ValueError("Invalid server argument: cannot start with '-'")
+
     args = [binary, "--format=json", "--accept-license", "--accept-gdpr"]
     args += ookla_interface_args(iface_name, ipv4)
     if server:

tests/test_speed.py

@@ -287,6 +287,15 @@ async def test_tier_ookla_success_parses_json():
         assert result.idle_rtt_ms == 15.5
 
 
+
+
+async def test_tier_ookla_server_argument_injection():
+    with pytest.raises(
+        ValueError, match="Invalid server argument: cannot start with '-'"
+    ):
+        await tier_ookla("speedtest", "--hacked", 10.0)
+
+
 async def test_tier_ookla_server_args():
     mock_proc = AsyncMock()
     mock_payload = {}