quote all arguments that could contain spaces before passing to execFile

wakatime · Nov 30, 2018 · e5ba512 · e5ba512
1 parent c4a3816
commit e5ba512
Showing 1 changed file with 24 additions and 15 deletions.
diff --git a/src/extension.ts b/src/extension.ts
@@ -272,30 +272,34 @@ export class WakaTime {
         this.dependencies.getPythonLocation(pythonBinary => {
           if (pythonBinary) {
             let core = this.dependencies.getCoreLocation();
-            let user_agent = 
+            let user_agent =
               this.agentName + '/' + vscode.version + ' vscode-wakatime/' + this.extension.version;
-            let args = [core, '--file', file, '--plugin', '"' + user_agent + '"'];
+            let args = [quote(core), '--file', quote(file), '--plugin', quote(user_agent)];
             let project = this.getProjectName(file);
-            if (project) args.push('--alternate-project', project);
+            if (project) args.push('--alternate-project', quote(project));
             if (isWrite) args.push('--write');
             if (Dependencies.isWindows()) {
               args.push(
                 '--config',
-                this.options.getConfigFile(),
+                quote(this.options.getConfigFile()),
                 '--logfile',
-                this.options.getLogFile(),
+                quote(this.options.getLogFile()),
               );
             }
 
             logger.debug('Sending heartbeat: ' + this.formatArguments(pythonBinary, args));
 
-            let process = child_process.execFile(pythonBinary, args, (error, stdout, stderr) => {
-              if (error != null) {
-                if (stderr && stderr.toString() != '') logger.error(stderr.toString());
-                if (stdout && stdout.toString() != '') logger.error(stdout.toString());
-                logger.error(error.toString());
-              }
-            });
+            let process = child_process.execFile(
+              quote(pythonBinary),
+              args,
+              (error, stdout, stderr) => {
+                if (error != null) {
+                  if (stderr && stderr.toString() != '') logger.error(stderr.toString());
+                  if (stdout && stdout.toString() != '') logger.error(stdout.toString());
+                  logger.error(error.toString());
+                }
+              },
+            );
             process.on('close', (code, signal) => {
               if (code == 0) {
                 this.statusBar.text = '$(clock)';
@@ -505,7 +509,7 @@ class Dependencies {
     logger.debug('Looking for python at: ' + binary);
 
     const args = ['--version'];
-    child_process.execFile(binary, args, (error, stdout, stderr) => {
+    child_process.execFile(quote(binary), args, (error, stdout, stderr) => {
       const output: string = stdout.toString() + stderr.toString();
       if (!error && this.isSupportedPythonVersion(binary, output)) {
         this.cachedPythonLocation = binary;
@@ -525,8 +529,8 @@ class Dependencies {
   private isCoreLatest(callback: (boolean) => void): void {
     this.getPythonLocation(pythonBinary => {
       if (pythonBinary) {
-        let args = [this.getCoreLocation(), '--version'];
-        child_process.execFile(pythonBinary, args, (error, stdout, stderr) => {
+        let args = [quote(this.getCoreLocation()), '--version'];
+        child_process.execFile(quote(pythonBinary), args, (error, stdout, stderr) => {
           if (!(error != null)) {
             let currentVersion = stderr.toString().trim();
             logger.debug('Current wakatime-core version is ' + currentVersion);
@@ -874,3 +878,8 @@ class Logger {
     this.log('error', msg);
   }
 }
+
+function quote(str) {
+  if (str.includes(' ')) return '"' + str.replace('"', '\\"') + '"';
+  return str;
+}