nuget updater command is already space-enabled; allow unsafe execution

nuget/lib/dependabot/nuget/native_helpers.rb

@@ -45,7 +45,7 @@ def self.run_nuget_framework_check(project_tfms, package_tfms)
 
         puts "running NuGet updater:\n" + command
 
-        output = SharedHelpers.run_shell_command(command, fingerprint: fingerprint)
+        output = SharedHelpers.run_shell_command(command, allow_unsafe_shell_command: true, fingerprint: fingerprint)
         puts output
 
         # Exit code == 0 means that all project frameworks are compatible
@@ -55,17 +55,11 @@ def self.run_nuget_framework_check(project_tfms, package_tfms)
         false
       end
 
-      # rubocop:disable Metrics/MethodLength
       sig do
-        params(
-          repo_root: String,
-          proj_path: String,
-          dependency: Dependency,
-          is_transitive: T::Boolean,
-          credentials: T::Array[T.untyped]
-        ).void
+        params(repo_root: String, proj_path: String, dependency: Dependency,
+               is_transitive: T::Boolean).returns([String, String])
       end
-      def self.run_nuget_updater_tool(repo_root:, proj_path:, dependency:, is_transitive:, credentials:)
+      def self.get_nuget_updater_tool_command(repo_root:, proj_path:, dependency:, is_transitive:)
         exe_path = File.join(native_helpers_root, "NuGetUpdater", "NuGetUpdater.Cli")
         command_parts = [
           exe_path,
@@ -103,14 +97,29 @@ def self.run_nuget_updater_tool(repo_root:, proj_path:, dependency:, is_transiti
           "--verbose"
         ].compact.join(" ")
 
+        [command, fingerprint]
+      end
+
+      sig do
+        params(
+          repo_root: String,
+          proj_path: String,
+          dependency: Dependency,
+          is_transitive: T::Boolean,
+          credentials: T::Array[Dependabot::Credential]
+        ).void
+      end
+      def self.run_nuget_updater_tool(repo_root:, proj_path:, dependency:, is_transitive:, credentials:)
+        (command, fingerprint) = get_nuget_updater_tool_command(repo_root: repo_root, proj_path: proj_path,
+                                                                dependency: dependency, is_transitive: is_transitive)
+
         puts "running NuGet updater:\n" + command
 
         NuGetConfigCredentialHelpers.patch_nuget_config_for_action(credentials) do
-          output = SharedHelpers.run_shell_command(command, fingerprint: fingerprint)
+          output = SharedHelpers.run_shell_command(command, allow_unsafe_shell_command: true, fingerprint: fingerprint)
           puts output
         end
       end
-      # rubocop:enable Metrics/MethodLength
     end
   end
 end

nuget/spec/dependabot/nuget/native_helpers_spec.rb

@@ -8,6 +8,47 @@
 RSpec.describe Dependabot::Nuget::NativeHelpers do
   let(:dependabot_home) { ENV.fetch("DEPENDABOT_HOME", nil) || Dir.home }
 
+  describe "nuget updater command path" do
+    let(:repo_root) { "/path/to/repo" }
+    let(:proj_path) { "/path/to/repo/src/some project/some_project.csproj" }
+    let(:dependency) do
+      Dependabot::Dependency.new(
+        name: "Some.Package",
+        version: "1.2.3",
+        previous_version: "1.2.2",
+        requirements: [{ file: "some_project.csproj", requirement: "1.2.3", groups: [], source: nil }],
+        previous_requirements: [{ file: "some_project.csproj", requirement: "1.2.2", groups: [], source: nil }],
+        package_manager: "nuget"
+      )
+    end
+    let(:is_transitive) { false }
+
+    subject(:command) do
+      (command,) = Dependabot::Nuget::NativeHelpers.get_nuget_updater_tool_command(repo_root: repo_root,
+                                                                                   proj_path: proj_path,
+                                                                                   dependency: dependency,
+                                                                                   is_transitive: is_transitive)
+      command = command.gsub(/^.*NuGetUpdater.Cli/, "/path/to/NuGetUpdater.Cli") # normalize path for unit test
+      command
+    end
+
+    it "returns a properly formatted command with spaces on the path" do
+      expect(command).to eq("/path/to/NuGetUpdater.Cli update --repo-root /path/to/repo " \
+                            '--solution-or-project /path/to/repo/src/some\ project/some_project.csproj ' \
+                            "--dependency Some.Package --new-version 1.2.3 --previous-version 1.2.2 " \
+                            "--verbose")
+    end
+
+    it "the tool runs with command line arguments properly interpreted" do
+      # This test will fail if the command line arguments weren't properly interpreted
+      Dependabot::Nuget::NativeHelpers.run_nuget_updater_tool(repo_root: repo_root,
+                                                              proj_path: proj_path,
+                                                              dependency: dependency,
+                                                              is_transitive: is_transitive,
+                                                              credentials: [])
+    end
+  end
+
   describe "#native_csharp_tests" do
     let(:command) do
       [