promise-spawn icon indicating copy to clipboard operation
promise-spawn copied to clipboard

Published 20 hours ago • verified publisher icon npm

[BUG] `spawnWithShell` is very, very broken on Windows

Open rotu opened this issue 1 year ago • 3 comments

Is there an existing issue for this?

  • [X] I have searched the existing issues

Current Behavior

There are multiple significant issues with spawnWithShell on Windows:

  1. It finds the executable by looking at the string and naively scanning for quotes. This doesn't respect ^-escaped spaces.

  2. This quote-scanning doesn't match types of quotes. For instance, "'my double quoted path'" will open quotes at the first " character and then say the quotes have ended at the ' character.

  3. Finally, the path is passed to which.sync with the quotes intact. So it's looking for an executable with those quotes in its path.

  4. The isCmd regex searches for \ but / is a legal alternative path separator on windows.

  5. Shell can be passed in. It's not unlikely that, if the user is on Windows, they're using PowerShell. In that case, I don't know what's supposed to happen.

Originally reported at https://github.com/npm/cli/issues/6716#issuecomment-1684566375

rotu avatar Sep 05 '23 20:09 rotu