wp-advads 1.0.38 → 1.0.39

package/package.json

@@ -1,7 +1,7 @@
 {
   "type": "module",
   "name": "wp-advads",
-  "version": "1.0.38",
+  "version": "1.0.39",
   "description": "Create an Advanced Ads WordPress plugin ecosystem.",
   "author": {
     "name": "Shakeeb Ahmed",

package/src/utilities/shell.js

@@ -3,46 +3,12 @@
  */
 import { spawn } from 'node:child_process'
 
-// cmd.exe metacharacters. See https://github.com/moxystudio/node-cross-spawn/blob/v7.0.6/lib/util/escape.js
-const WIN_META = /([()\][%!^"`<>&|;, *?])/g
-
-function escapeWinCommand( arg ) {
-	return String( arg ).replace( WIN_META, '^$1' )
-}
-
-function escapeWinArgument( arg ) {
-	let value = String( arg )
-	value = value.replace( /(?=(\\+?)?)\1"/g, '$1$1\\"' )
-	value = value.replace( /(?=(\\+?)?)\1$/, '$1$1' )
-	value = `"${value}"`
-	return value.replace( WIN_META, '^$1' )
-}
-
-/**
- * Windows argv spawn must go through cmd.exe so PATHEXT (.cmd/.bat) resolves.
- * Direct spawn('wp') looks for wp.exe only and throws ENOENT.
- *
- * @param {string} file Command name
- * @param {string[]} args Arguments
- * @param {string} [comspec] cmd.exe path
- * @returns {{ file: string, args: string[], options: Object }}
- */
-export function winArgvSpawnSpec( file, args, comspec = process.env.ComSpec || process.env.comspec || 'cmd.exe' ) {
-	const shellCommand = [ escapeWinCommand( file ), ...args.map( escapeWinArgument ) ].join( ' ' )
-	return {
-		file: comspec,
-		args: [ '/d', '/s', '/c', `"${shellCommand}"` ],
-		options: { shell: false, windowsVerbatimArguments: true },
-	}
-}
-
 function spawnArgv( file, args, spawnOpts ) {
 	if ( process.platform !== 'win32' ) {
 		return spawn( file, args, { ...spawnOpts, shell: false } )
 	}
 
-	const spec = winArgvSpawnSpec( file, args )
-	return spawn( spec.file, spec.args, { ...spawnOpts, ...spec.options } )
+	return spawn( file, args, { ...spawnOpts, shell: true } )
 }
 
 /**

package/test/shell.test.js

@@ -3,11 +3,11 @@
  * TASK-005: argv is not interpolated through a shell.
  */
 import assert from 'node:assert/strict'
-import { existsSync, rmSync } from 'node:fs'
+import { existsSync, readFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { test } from 'node:test'
-import { execCommand, runCommand, winArgvSpawnSpec } from '../src/utilities/shell.js'
+import { execCommand, runCommand } from '../src/utilities/shell.js'
 
 function execOnce( command ) {
 	return new Promise( ( resolve ) => {
@@ -131,23 +131,10 @@ test( 'execCommand does not ENOBUFS on stdout larger than 1MB', async () => {
 	}
 } )
 
-test( 'Windows argv spawn uses cmd.exe so PATHEXT commands like wp.cmd resolve', () => {
-	const spec = winArgvSpawnSpec( 'wp', [ 'i18n', 'make-pot' ], 'C:\\Windows\\system32\\cmd.exe' )
-	assert.equal( spec.file, 'C:\\Windows\\system32\\cmd.exe' )
-	assert.deepEqual( spec.args.slice( 0, 3 ), [ '/d', '/s', '/c' ] )
-	assert.match( spec.args[3], /wp/ )
-	assert.equal( spec.options.windowsVerbatimArguments, true )
-	assert.equal( spec.options.shell, false )
-} )
-
-test( 'Windows argv spawn escapes cmd metacharacters so headers and injection stay literal', () => {
-	const spec = winArgvSpawnSpec(
-		'wp',
-		[ '--headers={"Last-Translator":"A <b@c.com>"}', '& echo pwned' ],
-		'cmd.exe'
-	)
-	const line = spec.args[3]
-	assert.match( line, /\^</ )
-	assert.match( line, /\^>/ )
-	assert.match( line, /\^&/ )
+test( 'Windows argv spawn uses a shell so PATHEXT commands like wp.cmd resolve', () => {
+	const src = readFileSync( new URL( '../src/utilities/shell.js', import.meta.url ), 'utf8' )
+	const spawnArgv = src.split( 'function spawnArgv' )[1].split( 'export function' )[0]
+	assert.match( spawnArgv, /process\.platform !== 'win32'/ )
+	assert.match( spawnArgv, /shell:\s*false/ )
+	assert.match( spawnArgv, /shell:\s*true/ )
 } )