use puka for parsing and quoting run scripts

Closes: #3 Closes: #14 PR-URL: #17 Credit: @nlf Close: #17 Reviewed-by: @isaacs
npm · Nov 17, 2020 · da14d3b · da14d3b
1 parent a49e736
commit da14d3b
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 11 deletions.
diff --git a/lib/make-spawn-args.js b/lib/make-spawn-args.js
@@ -3,6 +3,24 @@ const isWindows = require('./is-windows.js')
 const setPATH = require('./set-path.js')
 const {resolve} = require('path')
 const npm_config_node_gyp = require.resolve('node-gyp/bin/node-gyp.js')
+const { quoteForShell, ShellString, ShellStringText, ShellStringUnquoted } = require('puka')
+
+const escapeCmd = cmd => {
+  const result = []
+  const parsed = ShellString.sh([cmd])
+  for (const child of parsed.children) {
+    if (child instanceof ShellStringText) {
+      const children = child.contents.filter(segment => segment !== null).map(segment => quoteForShell(segment, false, isWindows && 'win32'))
+      result.push(...children)
+    } else if (child instanceof ShellStringUnquoted) {
+      result.push(child.value)
+    } else {
+      result.push(isWindows ? '&' : ';')
+    }
+  }
+
+  return result.join('')
+}
 
 const makeSpawnArgs = options => {
   const {
@@ -16,7 +34,7 @@ const makeSpawnArgs = options => {
   } = options
 
   const isCmd = /(?:^|\\)cmd(?:\.exe)?$/i.test(scriptShell)
-  const args = isCmd ? ['/d', '/s', '/c', `"${cmd}"`] : ['-c', cmd]
+  const args = isCmd ? ['/d', '/s', '/c', escapeCmd(cmd)] : ['-c', escapeCmd(cmd)]
 
   const spawnOpts = {
     env: setPATH(path, {

diff --git a/test/make-spawn-args.js b/test/make-spawn-args.js
@@ -21,10 +21,10 @@ if (isWindows) {
     t.match(makeSpawnArgs({
       event: 'event',
       path: 'path',
-      cmd: 'script',
+      cmd: 'script "quoted parameter"; second command',
     }), [
       'cmd',
-      [ '/d', '/s', '/c', '"script"' ],
+      [ '/d', '/s', '/c', `script "quoted parameter"& second command` ],
       {
         env: {
           npm_package_json: /package\.json$/,
@@ -43,10 +43,10 @@ if (isWindows) {
     t.match(makeSpawnArgs({
       event: 'event',
       path: 'path',
-      cmd: 'script',
+      cmd: 'script "quoted parameter"; second command',
     }), [
       'blrorp',
-      [ '-c', 'script' ],
+      [ '-c', `script "quoted parameter"& second command` ],
       {
         env: {
           npm_package_json: /package\.json$/,
@@ -62,11 +62,11 @@ if (isWindows) {
     t.match(makeSpawnArgs({
       event: 'event',
       path: 'path',
-      cmd: 'script',
+      cmd: 'script "quoted parameter"; second command',
       scriptShell: 'cmd.exe',
     }), [
       'cmd.exe',
-      [ '/d', '/s', '/c', '"script"' ],
+      [ '/d', '/s', '/c', `script "quoted parameter"& second command` ],
       {
         env: {
           npm_package_json: /package\.json$/,
@@ -88,10 +88,10 @@ if (isWindows) {
     t.match(makeSpawnArgs({
       event: 'event',
       path: 'path',
-      cmd: 'script',
+      cmd: 'script "quoted parameter"; second command',
     }), [
       'sh',
-      [ '-c', 'script' ],
+      [ '-c', `script 'quoted parameter'; second command` ],
       {
         env: {
           npm_package_json: /package\.json$/,
@@ -109,11 +109,11 @@ if (isWindows) {
     t.match(makeSpawnArgs({
       event: 'event',
       path: 'path',
-      cmd: 'script',
+      cmd: 'script "quoted parameter"; second command',
       scriptShell: 'cmd.exe',
     }), [
       'cmd.exe',
-      [ '/d', '/s', '/c', '"script"' ],
+      [ '/d', '/s', '/c', `script 'quoted parameter'; second command` ],
       {
         env: {
           npm_package_json: /package\.json$/,