simpleqt opened a new pull request, #327:
URL: https://github.com/apache/commons-exec/pull/327
### What happens
`StringUtils.quoteArgument(String)` wraps an argument that contains a space
in double quotes, but it does not escape a backslash that sits in front of the
closing quote. `CommandLineToArgvW` (MSDN, "Parsing C++ Command-Line
Arguments") reads that backslash as escaping the quote, so the argument arrives
at the child process with the trailing backslash removed and a double quote
appended.
`DefaultExecutor` executes through `Runtime.exec(String[])`, and the JVM
launcher on Windows parses the resulting command line with the same rules, so
this is reachable from the public API:
```java
CommandLine cl = new CommandLine(javaExecutable);
cl.addArgument("-cp").addArgument(classpath);
cl.addArgument("Some Main").addArgument("C:\\Program Files\\");
new DefaultExecutor().execute(cl);
```
The child process receives `C:\Program Files"` instead of `C:\Program
Files\`. Any argument that has a space and ends in a backslash is affected -
for example a directory path used as an argument, a path inside `-Dkey=`, or a
batch script argument.
Arguments that contain a space but do not end in a backslash are not
affected, and arguments without a space are not quoted at all.
### Fix
Double the backslashes at the end of the double-quoted argument, so the
closing quote stays a delimiter. This is the same rule
`subprocess.list2cmdline()` in Python applies.
### Tests
`CommandLineTest.testAddArgumentEndingInBackslashIsDeliveredUnchanged`
starts a real child JVM through `DefaultExecutor` and asserts the arguments the
child recorded. Without the fix it fails with:
```
expected: <[C:\Program Files\, plain]> but was: <[C:\Program Files" plain]>
```
`StringUtilTest.testQuoteArgumentEndingInBackslash` pins the quoted form.
`CommandLineTest.testAddArgumentWithSpaceIsDeliveredUnchanged` and
`testAddArgumentEndingInBackslashWithoutSpaceIsNotQuoted` cover the
neighbouring cases that must not change.
Full local suite: `mvn test` - 133 tests, 0 failures, 0 errors (22 skipped,
the same as on master). `mvn verify` is green (RAT, changes-validate, jacoco
check).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
