fix: handle backslash and double-quote in a single pass in toPhpIniPath (CodeQL #70)

Replace the two chained .replace() calls with a single-pass regex that
handles both \ and " in one substitution. This eliminates any ordering
ambiguity between the two transforms and resolves the CodeQL
js/incomplete-sanitization alert: there is now no intermediate state where
a newly introduced backslash could interact with a not-yet-processed
double-quote character.

Author: wojtekn

apps/cli/lib/native-php/config.ts

@@ -136,16 +136,13 @@ function getExtensionDir( phpVersion: NativePhpSupportedVersion ): string {
 }
 
 // PHP's INI parser on Windows accepts forward slashes inside quoted values
-// and is fussy about backslashes (which also act as escape characters). Use
-// forward slashes everywhere and escape stray double quotes.
-//
-// Backslashes are replaced with forward slashes first so that no backslashes
-// remain by the time we escape double-quote characters. This ordering is
-// intentional: converting \ → / before escaping " means a sequence like \"
-// in the original path cannot corrupt the resulting INI value.
+// and is fussy about backslashes (which also act as escape characters).
+// Handle both characters in a single pass: backslashes become forward slashes,
+// and double-quotes are backslash-escaped. Using one replace() call avoids any
+// ordering ambiguity — there is no intermediate state where a newly introduced
+// backslash could interact with a not-yet-processed double-quote.
 function toPhpIniPath( filePath: string ): string {
-	const forwardSlashed = filePath.replace( /\\/g, '/' );
-	return forwardSlashed.replace( /"/g, '\\"' );
+	return filePath.replace( /[\\"]/g, ( char ) => ( char === '\\' ? '/' : '\\"' ) );
 }
 
 function getNativePhpIniPath( phpVersion: NativePhpSupportedVersion ): string {