Skip to content

Use ProcessUtils::escapeArgument() instead of escapeshellarg() #446

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Dec 11, 2018
Merged

Use ProcessUtils::escapeArgument() instead of escapeshellarg() #446

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion composer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,8 @@
},
"require-dev": {
"composer/composer": "^1.0.2",
"symfony/phpunit-bridge": "^3.4.19|^4.1.8"
"symfony/phpunit-bridge": "^3.4.19|^4.1.8",
"symfony/process": "^2.8"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't it be a non-dev requirement ? Otherwise, the method might be undefined at runtime.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It cannot be a non-dev requirement because that would prevent using flex with symfony >=3 apps.
But flex always runs in a composer context where process 2.8 is always available.

Copy link
Member

@stof stof Dec 11, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

but that would break in case Composer updates that (composer itself is already compatible with different versions of symfony/process in case you don't force it to install deps for PHP 5.3)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The composer.json of Composer has config.platform.php set to 5.3.9, so that only process 2.8 is ever installed. Its "require" is misleading.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the composer.lock and the platform config only impact the root project (so the composer phar). I know of other projects bringing in composer as a dependency. And then, newer versions can be used.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

btw, composer also has its own version of escapeArgument precisely because it could not stop using it easily, while they wanted to add support for newer Symfony versions

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I missed that one, fixed in #447

},
"autoload": {
"psr-4": {
Expand Down
7 changes: 4 additions & 3 deletions src/ScriptExecutor.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
use Symfony\Component\Console\Output\OutputInterface;
use Symfony\Component\Console\Output\StreamOutput;
use Symfony\Component\Process\PhpExecutableFinder;
use Symfony\Component\Process\ProcessUtils;

/**
* @author Fabien Potencier <[email protected]>
Expand Down Expand Up @@ -99,7 +100,7 @@ private function expandSymfonyCmd(string $cmd)
return null;
}

$console = escapeshellarg($this->options->get('bin-dir').'/console');
$console = ProcessUtils::escapeArgument($this->options->get('bin-dir').'/console');
if ($this->io->isDecorated()) {
$console .= ' --ansi';
}
Expand Down Expand Up @@ -127,8 +128,8 @@ private function expandPhpScript(string $cmd): string
$arguments[] = '--php-ini='.$ini;
}

$phpArgs = implode(' ', array_map('escapeshellarg', $arguments));
$phpArgs = implode(' ', array_map([ProcessUtils::class, 'escapeArgument'], $arguments));

return escapeshellarg($php).($phpArgs ? ' '.$phpArgs : '').' '.$cmd;
return ProcessUtils::escapeArgument($php).($phpArgs ? ' '.$phpArgs : '').' '.$cmd;
}
}