fix: update shell command built from environment values with additional improvements

Author: odaysec

packages/ui-mobile-visreg/package.json

@@ -46,7 +46,8 @@
     "@percy/cli": "^1.31.1",
     "@percy/client": "^1.31.1",
     "@percy/sdk-utils": "^1.31.1",
-    "lodash": "^4.17.21"
+    "lodash": "^4.17.21",
+    "shell-quote": "^1.8.3"
   },
   "devDependencies": {
     "@babel/core": "^7.28.0",

packages/ui-mobile-visreg/src/index.ts

@@ -1,6 +1,7 @@
 /// <reference types="detox" />
 
 import { execSync } from 'node:child_process';
+import shellQuote from 'shell-quote';
 
 import type { PercyScreenshotOptions } from './percy/processScreenshots';
 import processScreenshots from './percy/processScreenshots';
@@ -111,8 +112,9 @@ export function processScreenshotsForVisualDiffs(options: {
 }) {
   const screenshotsDir = options.screenshotsDir ? `/${options.screenshotsDir}` : '';
   const fullDirPath = `${baseDir}${screenshotsDir}`;
+  const quotedDirPath = shellQuote.quote([fullDirPath]);
 
-  processScreenshots(fullDirPath, options.processingOptions ?? {});
+  processScreenshots(quotedDirPath, options.processingOptions ?? {});
 }
 
 /**

packages/ui-mobile-visreg/src/percy/processScreenshots.ts

@@ -1,12 +1,14 @@
-import { runCmd } from '../utils';
+	import { runCmd } from '../utils';
+import shellQuote from 'shell-quote';
 
 export type PercyScreenshotOptions = {
   skipPercyUpload?: boolean;
   parallelPercy?: boolean;
 };
 
 function uploadImages(dirPath: string, parallelPercy = false) {
-  const percyUploadCmd = `percy upload -c ./.percy.yml -f "./*.{png,jpg,jpeg}" ${dirPath}`;
+  const safeDirPath = shellQuote.quote([dirPath]);
+  const percyUploadCmd = `percy upload -c ./.percy.yml -f "./*.{png,jpg,jpeg}" ${safeDirPath}`;
   const cmd = parallelPercy ? `percy exec --parallel -- ${percyUploadCmd}` : percyUploadCmd;
   runCmd(cmd);
 }
@@ -19,3 +21,4 @@ export default function processScreenshots(
     uploadImages(dirPath, parallelPercy);
   }
 }
+