refactor: validate Windows override values before shell injection

The wrapper injects org identifiers and Azure signing config into the
electron-builder command as double-quoted CLI overrides, then runs it through
spawnSync with shell:true (needed to split the space-separated multi-target
string into argv). A value containing a double quote, newline, or shell
metacharacter could shift argument boundaries or be expanded by the shell.

These values come from repo maintainers, not untrusted input, so this isn't a
security boundary — it's a fail-fast guard that surfaces a misconfigured repo
Variable here, where it's fixable, instead of as a malformed electron-builder
command line. Route both override sites through one helper that rejects the
quote-breaking characters.

The shell:true call itself is slated to go away in a future electron-builder
upgrade, passing argv as an array so no quoting is needed at all.

Author: cwillisf

scripts/electron-builder-wrapper.js

@@ -47,6 +47,30 @@ const getPlatformFlag = function () {
     throw new Error(`Could not determine platform flag for platform: ${process.platform}`);
 };
 
+/**
+ * Append a `--c.<key>="<value>"` electron-builder override after checking the value can't break out of
+ * its double quotes. electron-builder runs through spawnSync with shell:true (needed to split the
+ * space-separated multi-target string into argv), so a value containing a double quote, newline, or a
+ * shell metacharacter could shift argument boundaries or be expanded by the shell. These values come
+ * from repo maintainers (org identifiers, Azure signing config), not untrusted input, so this is a
+ * fail-fast guard against a misconfigured repo Variable — it surfaces the problem here, where it's
+ * fixable, rather than as a malformed electron-builder command line. (The shell:true call itself is
+ * slated to go away in a future electron-builder upgrade, passing argv as an array so no quoting is
+ * needed at all.)
+ * @param {Array<string>} args - the electron-builder argument array to append to.
+ * @param {string} key - the config key, e.g. 'appx.publisher'.
+ * @param {string} value - the value to inject.
+ */
+const pushQuotedOverride = function (args, key, value) {
+    if (/["\r\n`%]|\$\(/.test(value)) {
+        throw new Error(
+            `Refusing to inject --c.${key}: value contains a character that could break shell quoting ` +
+            '(one of " \\r \\n ` % or $(). Check the repo Variable or signing config that supplies it.'
+        );
+    }
+    args.push(`--c.${key}="${value}"`);
+};
+
 /**
  * Run `electron-builder` once to build one or more target(s).
  * @param {object} wrapperConfig - overall configuration object for the wrapper script.
@@ -78,8 +102,7 @@ const runBuilder = function (wrapperConfig, target) {
         // Organization-specific identifiers. electron-builder only expands ${env.X} macros in
         // filename fields like artifactName, not in config fields like these, so we inject them as
         // CLI overrides from the environment. Each is applied whenever its variable is set (a fork
-        // that doesn't set them builds with electron-builder's defaults). Values are double-quoted
-        // so spaces (e.g. a CN= publisher string) survive spawnSync(shell: true) re-tokenization.
+        // that doesn't set them builds with electron-builder's defaults).
         const idOverrides = {
             'appx.identityName': childEnvironment.APPX_IDENTITY_NAME,
             'appx.publisher': childEnvironment.APPX_PUBLISHER,
@@ -88,7 +111,7 @@ const runBuilder = function (wrapperConfig, target) {
         };
         for (const [key, value] of Object.entries(idOverrides)) {
             if (value) {
-                allArgs.push(`--c.${key}="${value}"`);
+                pushQuotedOverride(allArgs, key, value);
             }
         }
     }
@@ -114,14 +137,15 @@ const runBuilder = function (wrapperConfig, target) {
         if (missing.length > 0) {
             throw new Error(`Azure signing requires env vars: ${missing.join(', ')}`);
         }
-        // Wrap values in double quotes so spaces (e.g. a multi-word publisherName) survive shell
-        // re-tokenization. spawnSync(shell: true) joins argv with spaces and runs through cmd.exe /
-        // /bin/sh, so any internal whitespace would otherwise become an arg separator.
-        allArgs.push(
-            `--c.win.azureSignOptions.endpoint="${childEnvironment.AZURE_SIGNING_ENDPOINT}"`,
-            `--c.win.azureSignOptions.codeSigningAccountName="${childEnvironment.AZURE_SIGNING_ACCOUNT_NAME}"`,
-            `--c.win.azureSignOptions.certificateProfileName="${childEnvironment.AZURE_SIGNING_PROFILE_NAME}"`,
-            `--c.win.azureSignOptions.publisherName="${childEnvironment.AZURE_SIGNING_PUBLISHER_NAME}"`
+        pushQuotedOverride(allArgs, 'win.azureSignOptions.endpoint', childEnvironment.AZURE_SIGNING_ENDPOINT);
+        pushQuotedOverride(
+            allArgs, 'win.azureSignOptions.codeSigningAccountName', childEnvironment.AZURE_SIGNING_ACCOUNT_NAME
+        );
+        pushQuotedOverride(
+            allArgs, 'win.azureSignOptions.certificateProfileName', childEnvironment.AZURE_SIGNING_PROFILE_NAME
+        );
+        pushQuotedOverride(
+            allArgs, 'win.azureSignOptions.publisherName', childEnvironment.AZURE_SIGNING_PUBLISHER_NAME
         );
     }
     if (!wrapperConfig.doPackage) {