Refactor command argument escaping to use ProcessUtils for improved safety (#378)

MrPunyapal · web-flow · commit d4ef74ee1444 · 2025-07-10T12:39:13.000-05:00
diff --git a/overrides/Runner/Parallel/ProcessFactory.php b/overrides/Runner/Parallel/ProcessFactory.php
@@ -36,6 +36,7 @@
  * THE SOFTWARE.
  */
 
+use Illuminate\Support\ProcessUtils;
 use PhpCsFixer\Runner\RunnerConfig;
 use React\EventLoop\LoopInterface;
 use Symfony\Component\Console\Input\InputInterface;
@@ -118,7 +119,7 @@ public function getCommandArgs(int $serverPort, ProcessIdentifier $identifier, R
 
             if ($optionValue !== null) {
                 $commandArgs[] = "--{$option}";
-                $commandArgs[] = escapeshellarg($optionValue);
+                $commandArgs[] = ProcessUtils::escapeArgument($optionValue);
             }
         }
 

Original file line number	Diff line number	Diff line change
`@@ -36,6 +36,7 @@`
`36`	`36`	`* THE SOFTWARE.`
`37`	`37`	`*/`
`38`	`38`
	`39`	`+use Illuminate\Support\ProcessUtils;`
`39`	`40`	`use PhpCsFixer\Runner\RunnerConfig;`
`40`	`41`	`use React\EventLoop\LoopInterface;`
`41`	`42`	`use Symfony\Component\Console\Input\InputInterface;`
`@@ -118,7 +119,7 @@ public function getCommandArgs(int $serverPort, ProcessIdentifier $identifier, R`
`118`	`119`
`119`	`120`	`if ($optionValue !== null) {`
`120`	`121`	`$commandArgs[] = "--{$option}";`
`121`		`- $commandArgs[] = escapeshellarg($optionValue);`
	`122`	`+ $commandArgs[] = ProcessUtils::escapeArgument($optionValue);`
`122`	`123`	`}`
`123`	`124`	`}`
`124`	`125`