The proper fix would be to not use getent CLI tool in their logic, but instead use proper system APIs for looking up user account entries, like one of earlier comments here already mentions. This is shocking amateur hour!
My guess is they hastily threw together something hacky in early development, and forgot to replace it with a real, safe solution later.
My guess is they hastily threw together something hacky in early development, and forgot to replace it with a real, safe solution later.