Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[Process] Accept command line arrays and per-run env vars, fixing signaling and escaping #21474

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 8, 2017

Conversation

nicolas-grekas
Copy link
Member

@nicolas-grekas nicolas-grekas commented Jan 31, 2017

Q A
Branch? master
Bug fix? no
New feature? yes
BC breaks? no
Deprecations? yes
Tests pass? yes
Fixed tickets #12488, #11972, #10025, #11335, #5759, #5030, #19993, #10486
License MIT
Doc PR -

I think I found a way to fix this network of issues once for all.
Of all the linked ones, only the last two are still open: the remaining were closed in dead ends.

Instead of trying to make ProcessUtil::escapeArgument work correctly on Windows - which is impossible as discussed in #21347 - this PR deprecates it in favor of a more powerful approach.

Depending on the use case:

  • when a simple command should be run, Process now accepts an array of arguments (the "binary" being the first arg). Making this the responsibility of Process (instead of ProcessBuilder) gives two benefits:
    • escape becomes an internal detail that doesn't leak - thus can't be misused (see here)
    • since we know we're running a single command, we can prefix it automatically by "exec" - thus fixing a long standing issue with signaling
        $p = new Process(array('php', '-r', 'echo 123;'));
        echo $p->getCommandLine();
        // displays on Linux:
        // exec 'php' '-r' 'echo 123;'
  • when a shell expression is required, passing a string is still allowed. To make it easy and look-like sql prepared statements, env vars can be used when running the command. Since the shell is OS-specific (think Windows vs Linux) - this PR assumes no portability, so one should just use each shell's specific syntax.

From the fixtures:

        $env = array('FOO' => 'Foo', 'BAR' => 'Bar');
        $cmd = '\\' === DIRECTORY_SEPARATOR ? 'echo !FOO! !BAR! !BAZ!' : 'echo $FOO $BAR $BAZ';
        $p = new Process($cmd, null, $env);
        $p->run(null, array('BAR' => 'baR', 'BAZ' => 'baZ'));

        $this->assertSame('Foo baR baZ', rtrim($p->getOutput()));
        $this->assertSame($env, $p->getEnv());

@nicolas-grekas nicolas-grekas added this to the 3.3 milestone Jan 31, 2017
@nicolas-grekas nicolas-grekas force-pushed the proc-exec branch 2 times, most recently from ca8cba7 to ff267c9 Compare January 31, 2017 15:56
fabpot added a commit that referenced this pull request Jan 31, 2017
This PR was merged into the 2.7 branch.

Discussion
----------

[Console] Fix too strict test

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

required to make #21474 green in cross versions tests

Commits
-------

ee4b3e2 [Console] Fix too strict test
@nicolas-grekas nicolas-grekas force-pushed the proc-exec branch 2 times, most recently from dceca99 to 8dbcc59 Compare January 31, 2017 21:57
@fabpot
Copy link
Member

fabpot commented Feb 8, 2017

Thank you @nicolas-grekas.

@fabpot fabpot merged commit 330b61f into symfony:master Feb 8, 2017
fabpot added a commit that referenced this pull request Feb 8, 2017
…ars, fixing signaling and escaping (nicolas-grekas)

This PR was merged into the 3.3-dev branch.

Discussion
----------

[Process] Accept command line arrays and per-run env vars, fixing signaling and escaping

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | yes
| Tests pass?   | yes
| Fixed tickets | #12488, #11972, #10025, #11335, #5759, #5030, #19993, #10486
| License       | MIT
| Doc PR        | -

I think I found a way to fix this network of issues once for all.
Of all the linked ones, only the last two are still open: the remaining were closed in dead ends.

Instead of trying to make `ProcessUtil::escapeArgument` work correctly on Windows - which is impossible as discussed in #21347 - this PR deprecates it in favor of a more powerful approach.

Depending on the use case:

- when a simple command should be run, `Process` now accepts an array of arguments (the "binary" being the first arg). Making this the responsibility of `Process` (instead of `ProcessBuilder`) gives two benefits:
  - escape becomes an internal detail that doesn't leak - thus can't be misused ([see here](#21347 (comment)))
  - since we know we're running a single command, we can prefix it automatically by "exec" - thus fixing a long standing issue with signaling

```php
        $p = new Process(array('php', '-r', 'echo 123;'));
        echo $p->getCommandLine();
        // displays on Linux:
        // exec 'php' '-r' 'echo 123;'
```

- when a shell expression is required, passing a string is still allowed. To make it easy and look-like sql prepared statements, env vars can be used when running the command. Since the shell is OS-specific (think Windows vs Linux) - this PR assumes no portability, so one should just use each shell's specific syntax.

From the fixtures:
```php
        $env = array('FOO' => 'Foo', 'BAR' => 'Bar');
        $cmd = '\\' === DIRECTORY_SEPARATOR ? 'echo !FOO! !BAR! !BAZ!' : 'echo $FOO $BAR $BAZ';
        $p = new Process($cmd, null, $env);
        $p->run(null, array('BAR' => 'baR', 'BAZ' => 'baZ'));

        $this->assertSame('Foo baR baZ', rtrim($p->getOutput()));
        $this->assertSame($env, $p->getEnv());
```

Commits
-------

330b61f [Process] Accept command line arrays and per-run env vars, fixing signaling and escaping
@romainneutron
Copy link
Contributor

Was reviewing :) 👍 anyway

@mariusbalcytis
Copy link

Keep in mind that this can break things: 1) when exec was added manually by the developer (like in this commit) 2) when exec is not needed (like in this commit)

Maybe this should at least be mentioned in changelog? I should probably open a separate issue for this, I'm just not so sure this would help.

@nicolas-grekas
Copy link
Member Author

Please open an issue with a reproducer

@Bilge
Copy link
Contributor

Bilge commented Apr 26, 2017

This isn't going to be tagged for another eight months 😞

@nicolas-grekas
Copy link
Member Author

This will be released next month in 3.3

@Bilge
Copy link
Contributor

Bilge commented Apr 26, 2017

I guess someone set the due by date incorrectly, then. For what it's worth, I can confirm this fixes my issue.

@nicolas-grekas
Copy link
Member Author

the due date is set the end-of-support day :)

@fabpot fabpot mentioned this pull request May 1, 2017
fabpot added a commit to sensiolabs/SensioGeneratorBundle that referenced this pull request Jul 17, 2017
…avier)

This PR was squashed before being merged into the 3.1.x-dev branch (closes #564).

Discussion
----------

Fix deprecation notice in test (ProcessBuilder)

Backward- and forward-compatible fix for

```
Remaining deprecation notices (1)

The Symfony\Component\Process\ProcessBuilder class is deprecated since version 3.4 and will be removed in 4.0. Use the Process class instead: 1x
    1x in KernelManipulatorTest::testAddToArray from Sensio\Bundle\GeneratorBundle\Tests\Manipulator
```

Relevant commits:
- symfony/process@201c3bd (PR symfony/symfony#23111)
- symfony/process@e34416d (PR symfony/symfony#21474)
- symfony/process@0743280 (PR symfony/symfony#23498)

I also considered the simpler test `\Symfony\Component\HttpKernel\Kernel::VERSION_ID >= 30400` but it seems less reliable (version constant _vs_ code, possibly different versions of `symfony/http-kernel` _vs_ `symfony/process`).

Commits
-------

5fe7d3e Fix deprecation notice in test (ProcessBuilder)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants