wp-advads 1.0.37 → 1.0.38

package/package.json

@@ -1,7 +1,7 @@
 {
   "type": "module",
   "name": "wp-advads",
-  "version": "1.0.37",
+  "version": "1.0.38",
   "description": "Create an Advanced Ads WordPress plugin ecosystem.",
   "author": {
     "name": "Shakeeb Ahmed",

package/src/utilities/shell.js

@@ -3,6 +3,48 @@
  */
 import { spawn } from 'node:child_process'
 
+// cmd.exe metacharacters. See https://github.com/moxystudio/node-cross-spawn/blob/v7.0.6/lib/util/escape.js
+const WIN_META = /([()\][%!^"`<>&|;, *?])/g
+
+function escapeWinCommand( arg ) {
+	return String( arg ).replace( WIN_META, '^$1' )
+}
+
+function escapeWinArgument( arg ) {
+	let value = String( arg )
+	value = value.replace( /(?=(\\+?)?)\1"/g, '$1$1\\"' )
+	value = value.replace( /(?=(\\+?)?)\1$/, '$1$1' )
+	value = `"${value}"`
+	return value.replace( WIN_META, '^$1' )
+}
+
+/**
+ * Windows argv spawn must go through cmd.exe so PATHEXT (.cmd/.bat) resolves.
+ * Direct spawn('wp') looks for wp.exe only and throws ENOENT.
+ *
+ * @param {string} file Command name
+ * @param {string[]} args Arguments
+ * @param {string} [comspec] cmd.exe path
+ * @returns {{ file: string, args: string[], options: Object }}
+ */
+export function winArgvSpawnSpec( file, args, comspec = process.env.ComSpec || process.env.comspec || 'cmd.exe' ) {
+	const shellCommand = [ escapeWinCommand( file ), ...args.map( escapeWinArgument ) ].join( ' ' )
+	return {
+		file: comspec,
+		args: [ '/d', '/s', '/c', `"${shellCommand}"` ],
+		options: { shell: false, windowsVerbatimArguments: true },
+	}
+}
+
+function spawnArgv( file, args, spawnOpts ) {
+	if ( process.platform !== 'win32' ) {
+		return spawn( file, args, { ...spawnOpts, shell: false } )
+	}
+
+	const spec = winArgvSpawnSpec( file, args )
+	return spawn( spec.file, spec.args, { ...spawnOpts, ...spec.options } )
+}
+
 /**
  * Run a command in the terminal.
  *
@@ -38,7 +80,7 @@ export function execCommand( command, callback, options = {} ) {
 	}
 
 	const child = Array.isArray( command )
-		? spawn( command[0], command.slice( 1 ), { ...spawnOpts, shell: false } )
+		? spawnArgv( command[0], command.slice( 1 ), spawnOpts )
 		: spawn( command, { ...spawnOpts, shell: true } )
 
 	let stdout = ''

package/test/shell.test.js

@@ -7,7 +7,7 @@ import { existsSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { test } from 'node:test'
-import { execCommand, runCommand } from '../src/utilities/shell.js'
+import { execCommand, runCommand, winArgvSpawnSpec } from '../src/utilities/shell.js'
 
 function execOnce( command ) {
 	return new Promise( ( resolve ) => {
@@ -130,3 +130,24 @@ test( 'execCommand does not ENOBUFS on stdout larger than 1MB', async () => {
 		console.log = originalLog
 	}
 } )
+
+test( 'Windows argv spawn uses cmd.exe so PATHEXT commands like wp.cmd resolve', () => {
+	const spec = winArgvSpawnSpec( 'wp', [ 'i18n', 'make-pot' ], 'C:\\Windows\\system32\\cmd.exe' )
+	assert.equal( spec.file, 'C:\\Windows\\system32\\cmd.exe' )
+	assert.deepEqual( spec.args.slice( 0, 3 ), [ '/d', '/s', '/c' ] )
+	assert.match( spec.args[3], /wp/ )
+	assert.equal( spec.options.windowsVerbatimArguments, true )
+	assert.equal( spec.options.shell, false )
+} )
+
+test( 'Windows argv spawn escapes cmd metacharacters so headers and injection stay literal', () => {
+	const spec = winArgvSpawnSpec(
+		'wp',
+		[ '--headers={"Last-Translator":"A <b@c.com>"}', '& echo pwned' ],
+		'cmd.exe'
+	)
+	const line = spec.args[3]
+	assert.match( line, /\^</ )
+	assert.match( line, /\^>/ )
+	assert.match( line, /\^&/ )
+} )