Arguments given to spawn/spawnSync on Windows breaks on spaces within quoted arguments

[alshdavid]

Version

16.15.0

Platform

Windows 11

Subsystem

No response

What steps will reproduce the bug?

I am trying to write automation scripts (like build scripts) in JavaScript so they run across all platforms supported by Node. I have been building a wrapper around spawn and spawnSync that guarantees execution on all environments. I cannot use any third party libraries because I don't want people to have to run npm install before running my scripts. I am currently having trouble with the parsing of command line arguments in Windows.

Create two files:

// index.js
const childProcess = require('child_process')

childProcess.spawnSync('node', ['target.js', 'Hello World'], {
  shell: true,
  cwd: __dirname,
  stdio: 'inherit',
})

And

// target.js
console.log(process.argv)

How often does it reproduce? Is there a required condition?

Every time

What is the expected behavior?

The terminal would have output:

[
  'C:\\Program Files\\nodejs\\node.exe',
  'C:\\Users\\User Name\\Desktop\\foo\\target.js',
  'Hello World'
]

What do you see instead?

The terminal I get the following output:

[
  'C:\\Program Files\\nodejs\\node.exe',
  'C:\\Users\\User Name\\Desktop\\foo\\target.js',
  'Hello',
  'World'
]

Additional information

No response

[alshdavid]

Running target.js with arguments directly works as expected

however through spawn it's broken. I have tried windowsVerbatimArguments and pointing shell directly to PowerShell:

For comparison, running the same operation in Golang results in the correct output:

[bnoordhuis]

You have a bug in your code on this line:

if (process.platform === 'win32' && process.arch === 'x32') {

Replace x32 with ia32, otherwise the 64 bits version runs inside powershell while the 32 bits does not. I'll convert this to a discussion.

[bnoordhuis]

Can you explain why you're passing shell: true when you're invoking node directly? Without shell, I think your example works the way you want it to.

If you do want to use shell: true and windowsVerbatimArguments: true, then you're responsible for ensuring arguments are properly quoted and escaped.

[alshdavid]

Oh ok, interesting. Why does it work when I remove shell: true?

Also when removing shell: true, I get ENOENT when trying to run pnpm, any idea why that is the case?

[bnoordhuis]

With shell: true you're basically invoking cmd.exe /c "node target.js Hello World". Node acts as if windowsVerbatimArguments is true when you pass it through cmd.exe, i.e., it doesn't escape or quote.

That ENOENT is because pnpm is probably a shell script (a .bat or .cmd file.) Executing those on Windows is a property of the shell, not the operating system like it is on Unix systems.

[alshdavid]

I see. Is it possible to specify the shell as PowerShell while also automatically escaping spaces in arguments passed in?

That ENOENT is because pnpm is probably a shell script (a .bat or .cmd file.)

Ah yeah I see. That's correct, it's a .bat file.

[bnoordhuis]

Quoting is the default with shell: "powershell.exe", it's only disabled when shelling out to cmd.exe.