fix(typespec-python): remove shell:true from spawn to eliminate DEP0190 deprecation warning - #5001
fix(typespec-python): remove shell:true from spawn to eliminate DEP0190 deprecation warning#5001l0lawrence with Copilot wants to merge 3 commits into
Conversation
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
…P0190 deprecation warning Co-authored-by: l0lawrence <100643745+l0lawrence@users.noreply.github.com>
microsoft-github-policy-service
Bot
added
the
emitter:python
| ): Promise<ExecResult> => { | ||
| return new Promise((resolve, reject) => { | ||
| const cp = spawn(command, cmdlineargs, { ...options, stdio: "pipe", shell: true }); | ||
| const cp = spawn(command, cmdlineargs, { ...options, stdio: "pipe" }); |
There was a problem hiding this comment.
what is command going to be, is that cross platform compatible?
There was a problem hiding this comment.
I think it can be py,python3, or python
There was a problem hiding this comment.
But isn't it python.cmd on windows. I think this is the reason shell was set to true so it works on windows. It is good to remove shell: true but I think need to use crossspawn package instead or need to be smarter about finding the command
There was a problem hiding this comment.
I thought it was .exe but let me look
There was a problem hiding this comment.
ok just wanted to make sure it does actually work across platforms, windows is super annoying with what you can call with spawn. If it does then this looks good
commit: |
…ments.ts Restores Windows support for executing .cmd/.bat wrappers (e.g. python.cmd) that was lost when shell:true was removed, while keeping the DEP0190 deprecation warning fixed. cross-spawn handles arg escaping, so manual quoting is not needed. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a400ee01-6085-4bac-a9a0-e3ac44faadca
Node.js DEP0190 warns that passing an args array to
spawnwithshell: trueis insecure — args are concatenated rather than escaped. This warning was being emitted during both theinstallandpreparesteps oftypespec-python.Changes
system-requirements.ts—execute(): Removeshell: truefrom thespawnoptions. Arguments are already passed as an array, so the shell is unnecessary.system-requirements.ts—tryPython(): Remove the wrapping double-quotes aroundPRINT_PYTHON_VERSION_SCRIPT. Those quotes were shell-interpreted (and stripped) whenshell: truewas active. Without the shell, they would be passed as literal"characters to Python's-cflag, breaking version detection.