|
| 1 | +/** |
| 2 | + * Cross-platform command launching (devlog 260715_cross_platform_audit/020). |
| 3 | + * |
| 4 | + * Windows npm installs expose CLIs as `.cmd` shims, and Node/Bun refuse shell-less |
| 5 | + * `.cmd` spawns (CVE-2024-27980 hardening). Bare names like `spawn("claude")` also |
| 6 | + * skip PATHEXT resolution entirely, so they ENOENT even when `claude.cmd` is on PATH. |
| 7 | + * This module mirrors the battle-tested cross-spawn approach: resolve the real target |
| 8 | + * via PATH×PATHEXT, launch `.exe` targets directly (argument boundaries preserved by |
| 9 | + * the normal shell-less spawn), and route `.cmd`/`.bat` targets through |
| 10 | + * `cmd.exe /d /s /c "<escaped line>"` with `windowsVerbatimArguments: true`. |
| 11 | + */ |
| 12 | +import { existsSync } from "node:fs"; |
| 13 | +import { win32 } from "node:path"; |
| 14 | + |
| 15 | +const CMD_META = /([()\][%!^"`<>&|;, *?])/g; |
| 16 | +/** cross-spawn parse.js: only npm local-bin shims get double escaping. */ |
| 17 | +const IS_CMD_SHIM = /node_modules[\\/].bin[\\/][^\\/]+\.cmd$/i; |
| 18 | + |
| 19 | +/** cross-spawn escape.js argument(): quote + escape one argument for cmd.exe /d /s /c. */ |
| 20 | +export function escapeCmdArg(arg: string, doubleEscape = false): string { |
| 21 | + let out = String(arg).replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/, "$1$1"); |
| 22 | + out = `"${out}"`.replace(CMD_META, "^$1"); |
| 23 | + return doubleEscape ? out.replace(CMD_META, "^$1") : out; |
| 24 | +} |
| 25 | + |
| 26 | +/** cross-spawn escape.js command(): escape the command token itself (no quoting). */ |
| 27 | +export function escapeCmdCommand(command: string): string { |
| 28 | + return command.replace(CMD_META, "^$1"); |
| 29 | +} |
| 30 | + |
| 31 | +export interface ResolveDeps { |
| 32 | + env?: Record<string, string | undefined>; |
| 33 | + exists?: (path: string) => boolean; |
| 34 | +} |
| 35 | + |
| 36 | +/** |
| 37 | + * Resolve a bare command name to its first PATH×PATHEXT hit (win32 semantics). |
| 38 | + * Commands that already carry an extension, a separator, or an absolute prefix are |
| 39 | + * returned unchanged; unresolvable names fall back unchanged (spawn will surface it). |
| 40 | + */ |
| 41 | +export function resolveWindowsCommand(command: string, deps: ResolveDeps = {}): string { |
| 42 | + const env = deps.env ?? process.env; |
| 43 | + const exists = deps.exists ?? existsSync; |
| 44 | + if (win32.extname(command) || command.includes("\\") || command.includes("/") || win32.isAbsolute(command)) { |
| 45 | + return command; |
| 46 | + } |
| 47 | + const exts = (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean); |
| 48 | + for (const dir of (env.PATH ?? env.Path ?? "").split(win32.delimiter).filter(Boolean)) { |
| 49 | + for (const ext of exts) { |
| 50 | + const candidate = win32.join(dir, command + ext.toLowerCase()); |
| 51 | + if (exists(candidate)) return candidate; |
| 52 | + } |
| 53 | + } |
| 54 | + return command; |
| 55 | +} |
| 56 | + |
| 57 | +export interface SpawnInvocation { |
| 58 | + file: string; |
| 59 | + args: string[]; |
| 60 | + options: { windowsVerbatimArguments?: boolean }; |
| 61 | +} |
| 62 | + |
| 63 | +/** |
| 64 | + * Platform-safe invocation preserving argument boundaries (cross-spawn parse.js). |
| 65 | + * POSIX: passthrough. win32 `.exe`: resolved direct spawn. win32 `.cmd`/`.bat`: |
| 66 | + * `ComSpec /d /s /c "<escaped command line>"` with verbatim args; npm local-bin |
| 67 | + * shims get cross-spawn's double escaping, all other batch targets single. |
| 68 | + */ |
| 69 | +export function commandInvocation( |
| 70 | + command: string, |
| 71 | + args: readonly string[], |
| 72 | + platform: NodeJS.Platform = process.platform, |
| 73 | + deps: ResolveDeps = {}, |
| 74 | +): SpawnInvocation { |
| 75 | + if (platform !== "win32") return { file: command, args: [...args], options: {} }; |
| 76 | + const resolved = resolveWindowsCommand(command, deps); |
| 77 | + if (!/\.(cmd|bat)$/i.test(resolved)) return { file: resolved, args: [...args], options: {} }; |
| 78 | + const env = deps.env ?? process.env; |
| 79 | + const doubleEscape = IS_CMD_SHIM.test(resolved); |
| 80 | + const line = [escapeCmdCommand(resolved), ...args.map(a => escapeCmdArg(a, doubleEscape))].join(" "); |
| 81 | + return { |
| 82 | + file: env.ComSpec ?? "cmd.exe", |
| 83 | + args: ["/d", "/s", "/c", `"${line}"`], |
| 84 | + options: { windowsVerbatimArguments: true }, |
| 85 | + }; |
| 86 | +} |
| 87 | + |
| 88 | +/** |
| 89 | + * `sh -c <command>` analog per platform. The configured command string is passed |
| 90 | + * VERBATIM in content; on win32 it gets the outer quotes `/s` requires, so |
| 91 | + * `"C:\Program Files\x.exe" --json` runs as `cmd.exe /d /s /c ""C:\Program Files\x.exe" --json"`. |
| 92 | + * Contract: the command is platform-native shell syntax (sh on POSIX, CMD on Windows). |
| 93 | + */ |
| 94 | +export function shellInvocation( |
| 95 | + command: string, |
| 96 | + platform: NodeJS.Platform = process.platform, |
| 97 | + env: Record<string, string | undefined> = process.env, |
| 98 | +): SpawnInvocation { |
| 99 | + if (platform !== "win32") return { file: "sh", args: ["-c", command], options: {} }; |
| 100 | + return { |
| 101 | + file: env.ComSpec ?? "cmd.exe", |
| 102 | + args: ["/d", "/s", "/c", `"${command}"`], |
| 103 | + options: { windowsVerbatimArguments: true }, |
| 104 | + }; |
| 105 | +} |
0 commit comments