fix: CDK app fails to launch if paths contain spaces #645
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
rix0rrr
changed the title
…wn-cross-platform
…wn-cross-platform
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When executing CDK apps, users specify the command as a string. The only feasible interpretation of that is by executing the command line through a shell, either
bashorcmd.exe. We are using shell execution on purpose; it's used for tests, it's necessary on Windows to properly execute.batand.cmdfiles, and since we have historically offered it you can bet dollars to doughnuts that customers have built workflows depending on that.Note that the source of the string and the machine it's executing on are part of the same security domain: it's all "the customer". The customer writes the command string, then executes it on their own machine. Customers don't build strings from untrusted sources.
However, in code we did do trivial parsing of that
stringtostring[], do some manipulation, and then combine it back to astring, by doing splitting and joining on" ". This led to an error on Windows systems where we would build an invalid command line if the path points to a.jsfile and the path to the Node interpreter has spaces in it (C:\Program Files) (or the path of the.jsfile itself).Instead of splitting and joining on on
" ", in this PR we parse and join according to the rules of the shell (be it either POSIX-compatible or cmd.exe-compatible). This is quite tricky and it might be incorrect. Still, we are not doing this with the goal of nullifying the active shell characters; we are just trying to account for quotes and spaces.This PR fixes several instances where we were building a command line by joining an array of command line arguments with spaces. This would then cause problems if any of the parts of the command line contain spaces themselves, because we have lost information about the argument separators.
Instead, keep the structure information (keeping the command line in
string[]form as long as possible) so that on Windows, where spaces in command lines are common, executions don't fail.Closes #636
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license