Failed to properly account for ' in string

[womalley]

Issue Description

You guys haven't properly escaped/enclosed the strings you're using in the following build targets:

Microsoft.NET.Sdk.Razor.StaticWebAssets.targets

Deleting/renaming the user folder is not possible as the folder was created when the Azure Active Directory user was added to the computer.

Steps to Reproduce

1. Login to a computer using a user account that contains an apostrophe in the name
2. Open a .net core 3.1 project, or any other project that uses the Microsoft.NET.Sdk.Razor.StaticWebAssets.targets build target
3. Try to build the project and/or run the project
4. An error will be thrown similar to the error added to the "Actual Behavior" section below

This is where the error is initially thrown in the build target:

Expected Behavior

The project should properly reference the file and the project will build

Actual Behavior

The file can't be referenced because the file path contains an apostrophe (') within the user's folder name. This can be seen by the bolded folder name in the error below:

MSB4113 Specified condition "$([System.String]::Copy('%(Identity)').Replace('','/').StartsWith('wwwroot/'))" evaluates to "$([System.String]::Copy('C:\Users*BillO'Malley*.nuget\packages\wkhtmlwrapper.image\1.0.89\contentFiles\any\netstandard2.0\Executables\image.win.exe').Replace('','/').StartsWith('wwwroot/'))" instead of a boolean.

Analysis

Folder and file paths must allow for special characters and the Microsoft.NET.Sdk.Razor.StaticWebAssets.targets build target should escape these characters.

Versions & Configurations

Microsoft (R) Build Engine version 16.8.3+39993bd9d for .NET Framework
Copyright (C) Microsoft Corporation. All rights reserved.

16.8.3.61104

[benvillalobos]

Team Triage: Microsoft.NET.Sdk.Razor.StaticWebAssets.targets lives in the SDK.

[benvillalobos]

Initial investigation notes:

The issue isn't specifically with Microsoft.NET.Sdk.Razor.StaticWebAssets.targets, it has to do with how we handle single quotes with metadata.

I can successfully repro this with any metadata that contains a '. Here's my repro project:

  <ItemGroup>
    <Content Include="c:\some\path\with\user'name\file.txt">
      <MetadataWithPercent>c:/some%stuff</MetadataWithPercent>
      <MetadataWithsinglequote>c:/some'stuff</MetadataWithsinglequote>
      <MetadataWithEscapedSingleQuote>c:/some%27stuff</MetadataWithEscapedSingleQuote>
    </Content>
  </ItemGroup>

  <Target Name="6203">
    <ItemGroup>
      <SomeType Include="@(Content)"
                Condition="$([System.String]::Copy('%(Content.MetadataWithsinglequote)').Replace('\', '/').StartsWith('c:/'))">
      </SomeType>
    </ItemGroup>
  </Target>

The build passes if I use Content.MetadataWithEscapedSingleQuote but fails on MetadataWithsinglequote.

My initial thoughts for a solution would be to make sure to escape all special characters (though it looks like only the single quote would need this) when pulling the metadata out.

Notable areas of code:
Expander line 764 is where we regex-replace metadata with their actual values when parsing an expression.

There's a bit of a workaround if you store your projects outside of your user path, c:/src for example.

[rainersigwald]

I was hoping that this could also be resolved in NuGet's handling of NuGet package content. If I create a classlib project that references

    <PackageReference Include="WkHtmlWrapper.Image" Version="1.0.89" />

The restore-generated .nuget.g.props has this in it:

  <ItemGroup Condition=" '$(ExcludeRestorePackageImports)' != 'true' ">
    <Content Include="$(NuGetPackageRoot)wkhtmlwrapper.image/1.0.89/contentFiles/any/netstandard2.0/Executables/image.win.exe" Condition="Exists('$(NuGetPackageRoot)wkhtmlwrapper.image/1.0.89/contentFiles/any/netstandard2.0/Executables/image.win.exe')">
      <NuGetPackageId>WkHtmlWrapper.Image</NuGetPackageId>
      <NuGetPackageVersion>1.0.89</NuGetPackageVersion>
      <NuGetItemType>Content</NuGetItemType>
      <Pack>false</Pack>
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <TargetPath>Executables/image.win.exe</TargetPath>
      <DestinationSubDirectory>Executables/</DestinationSubDirectory>
      <Private>True</Private>
      <Link>Executables/image.win.exe</Link>
    </Content>
  </ItemGroup>

If $(NuGetPackageRoot) has a ' in it, you hit this problem. Unfortunately, you can't escape that property when defining it, because then the Exists condition doesn't work correctly.

Ideally, we'd be in a proper recursive parser and know which quote matched which. But since we've had confusing textual-expansion-in-place behavior for a long time, that would be a pretty big behavior change.