feat: bumping shescape, adding hardening

Author: dotkas

lib/sub-process.ts

@@ -1,5 +1,6 @@
 import * as childProcess from 'child_process';
-import { quoteAll } from 'shescape/stateless';
+import { escapeAll, quoteAll } from 'shescape/stateless';
+import * as os from 'node:os';
 
 export function execute(
   command: string,
@@ -9,13 +10,26 @@ export function execute(
   const spawnOptions: {
     shell: boolean;
     cwd?: string;
-  } = { shell: true };
+  } = { shell: false };
   if (options && options.cwd) {
     spawnOptions.cwd = options.cwd;
   }
 
-  args = quoteAll(args, { flagProtection: false });
-
+  if (args) {
+    // Best practices, also security-wise, is to not invoke processes in a shell, but as a stand-alone command.
+    // However, on Windows, we need to invoke the command in a shell, due to internal NodeJS problems with this approach
+    // see: https://nodejs.org/docs/latest-v24.x/api/child_process.html#spawning-bat-and-cmd-files-on-windows
+    const isWinLocal = /^win/.test(os.platform());
+    if (isWinLocal) {
+      spawnOptions.shell = true;
+      // Further, we distinguish between quoting and escaping arguments since quoteAll does not support quoting without
+      // supplying a shell, but escapeAll does.
+      // See this (very long) discussion for more details: https://github.com/ericcornelissen/shescape/issues/2009
+      args = quoteAll(args, { ...spawnOptions, flagProtection: false });
+    } else {
+      args = escapeAll(args, { ...spawnOptions, flagProtection: false });
+    }
+  }
   return new Promise((resolve, reject) => {
     let stdout = '';
     let stderr = '';
@@ -28,6 +42,12 @@ export function execute(
       stderr = stderr + data;
     });
 
+    // Handle spawn errors (e.g., ENOENT when command doesn't exist)
+    proc.on('error', (error) => {
+      stderr = error.message;
+      reject({ stdout, stderr });
+    });
+
     proc.on('close', (code: number) => {
       if (code !== 0) {
         return reject(new Error(stdout || stderr));

package.json

@@ -34,7 +34,7 @@
     "@snyk/cli-interface": "^2.11.0",
     "@snyk/cocoapods-lockfile-parser": "3.6.2",
     "@snyk/dep-graph": "^1.23.1",
-    "shescape": "2.1.4",
+    "shescape": "2.1.6",
     "source-map-support": "^0.5.7",
     "tslib": "^2.0.0"
   },