Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[Process] Windows escaping is not consistent #10486

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
romainneutron opened this issue Mar 18, 2014 · 1 comment
Closed

[Process] Windows escaping is not consistent #10486

romainneutron opened this issue Mar 18, 2014 · 1 comment

Comments

@romainneutron
Copy link
Contributor

After digging more on Windows escaping, I realised some things:

  • We forbid environment variable expansion by escaping %APPDATA% to ^%"APPDATA"^%
  • We explicitly ask for variable expansion at runtime (running the command line with the /V:ON flag). Running a command containing !APPDATA! will be escaped and expanded (our previous rule is easily overriden)
  • On platform that are not windows, we use strong escaping that prevents any variable expansion ($PATH will be escaped to '$PATH' that is not interpreted as the current PATH)

We have three possibilities:

Any thoughts about this ?

@nicolas-grekas
Copy link
Member

nicolas-grekas commented Jan 12, 2017

Now that we're able to inject env vars in the config, I think we should disable delayed expansion in 4.0, thus trigger a deprecation in 3.3.
Anyone who'd like to give it a try, triggering a deprecation when !VAR! is used?

@nicolas-grekas nicolas-grekas added this to the 3.3 milestone Jan 12, 2017
fabpot added a commit that referenced this issue Feb 8, 2017
…ars, fixing signaling and escaping (nicolas-grekas)

This PR was merged into the 3.3-dev branch.

Discussion
----------

[Process] Accept command line arrays and per-run env vars, fixing signaling and escaping

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | yes
| Tests pass?   | yes
| Fixed tickets | #12488, #11972, #10025, #11335, #5759, #5030, #19993, #10486
| License       | MIT
| Doc PR        | -

I think I found a way to fix this network of issues once for all.
Of all the linked ones, only the last two are still open: the remaining were closed in dead ends.

Instead of trying to make `ProcessUtil::escapeArgument` work correctly on Windows - which is impossible as discussed in #21347 - this PR deprecates it in favor of a more powerful approach.

Depending on the use case:

- when a simple command should be run, `Process` now accepts an array of arguments (the "binary" being the first arg). Making this the responsibility of `Process` (instead of `ProcessBuilder`) gives two benefits:
  - escape becomes an internal detail that doesn't leak - thus can't be misused ([see here](#21347 (comment)))
  - since we know we're running a single command, we can prefix it automatically by "exec" - thus fixing a long standing issue with signaling

```php
        $p = new Process(array('php', '-r', 'echo 123;'));
        echo $p->getCommandLine();
        // displays on Linux:
        // exec 'php' '-r' 'echo 123;'
```

- when a shell expression is required, passing a string is still allowed. To make it easy and look-like sql prepared statements, env vars can be used when running the command. Since the shell is OS-specific (think Windows vs Linux) - this PR assumes no portability, so one should just use each shell's specific syntax.

From the fixtures:
```php
        $env = array('FOO' => 'Foo', 'BAR' => 'Bar');
        $cmd = '\\' === DIRECTORY_SEPARATOR ? 'echo !FOO! !BAR! !BAZ!' : 'echo $FOO $BAR $BAZ';
        $p = new Process($cmd, null, $env);
        $p->run(null, array('BAR' => 'baR', 'BAZ' => 'baZ'));

        $this->assertSame('Foo baR baZ', rtrim($p->getOutput()));
        $this->assertSame($env, $p->getEnv());
```

Commits
-------

330b61f [Process] Accept command line arrays and per-run env vars, fixing signaling and escaping
@fabpot fabpot closed this as completed Feb 8, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants