Reject unsafe backticks in PowerShell environment variable names

Author: vortsghost2025

pkg/util/shellutil/tokenswap.go

@@ -125,8 +125,8 @@ func encodeEnvVarsForPowerShell(env map[string]string) (string, error) {
 	var encoded string
 	for k, v := range env {
 		// PowerShell's braced environment-variable syntax supports Windows names
-		// such as ProgramFiles(x86), but a closing brace cannot be represented.
-		if k == "" || strings.Contains(k, "}") {
+		// such as ProgramFiles(x86), but backticks and closing braces cannot be represented safely.
+		if k == "" || strings.ContainsAny(k, "}`") {
 			return "", fmt.Errorf("invalid env var name: %q", k)
 		}
 		encoded += fmt.Sprintf("${env:%s} = %s\n", k, HardQuotePowerShell(v))

pkg/util/shellutil/tokenswap_test.go

@@ -46,7 +46,7 @@ func TestEncodeEnvVarsForPowerShell(t *testing.T) {
 }
 
 func TestEncodeEnvVarsForPowerShellRejectsUnrepresentableNames(t *testing.T) {
-	for _, name := range []string{"", "invalid}name"} {
+	for _, name := range []string{"", "invalid}name", "FOO`"} {
 		t.Run(name, func(t *testing.T) {
 			if _, err := EncodeEnvVarsForShell(ShellType_pwsh, map[string]string{name: "value"}); err == nil {
 				t.Errorf("EncodeEnvVarsForShell() accepted unrepresentable name %q", name)