From 2837585e47d4192fa3931aa09e9810bdab6487db Mon Sep 17 00:00:00 2001 From: John Stevenson Date: Thu, 12 May 2022 20:13:55 +0100 Subject: [PATCH] Fix cmd splitting paths on commas (#10775) --- src/Composer/Util/ProcessExecutor.php | 3 ++- tests/Composer/Test/Util/ProcessExecutorTest.php | 3 +++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/src/Composer/Util/ProcessExecutor.php b/src/Composer/Util/ProcessExecutor.php index 16352bbcf..ca181d7d3 100644 --- a/src/Composer/Util/ProcessExecutor.php +++ b/src/Composer/Util/ProcessExecutor.php @@ -490,7 +490,8 @@ class ProcessExecutor // New lines break cmd.exe command parsing $argument = strtr($argument, "\n", ' '); - $quote = strpbrk($argument, " \t") !== false; + // In addition to whitespace, commas need quoting to preserve paths + $quote = strpbrk($argument, " \t,") !== false; $argument = Preg::replace('/(\\\\*)"/', '$1$1\\"', $argument, -1, $dquotes); $meta = $dquotes || Preg::isMatch('/%[^%]+%|![^!]+!/', $argument); diff --git a/tests/Composer/Test/Util/ProcessExecutorTest.php b/tests/Composer/Test/Util/ProcessExecutorTest.php index ff2acd82e..13bf31cbc 100644 --- a/tests/Composer/Test/Util/ProcessExecutorTest.php +++ b/tests/Composer/Test/Util/ProcessExecutorTest.php @@ -178,6 +178,9 @@ class ProcessExecutorTest extends TestCase // no whitespace must not be quoted 'no-ws' => array('abc', 'abc', "'abc'"), + // commas must be quoted + 'comma' => array('a,bc', '"a,bc"', "'a,bc'"), + // double-quotes must be backslash-escaped 'dq' => array('a"bc', 'a\^"bc', "'a\"bc'"),