Invoke the CLI directly instead of building command strings in package-msix.ps1 - #725
Conversation
…e-msix.ps1 The four CLI invocations in package-msix.ps1 built a command string via string interpolation and then ran it through Invoke-Expression. Paths and package names flowed into that string, so any character with meaning to the PowerShell parser (quotes, semicolons, ampersands) would have been re-interpreted rather than passed through as data. Use the call operator with an argument array instead, and splat it. $CertParam becomes $CertArgs so the certificate path is a discrete argument rather than a pre-quoted fragment of a larger string. The Write-Host command echoes are kept for build-log readability but are now display-only.
There was a problem hiding this comment.
Pull request overview
Replaces Invoke-Expression with direct CLI invocation to prevent PowerShell from reinterpreting argument data.
Changes:
- Uses the call operator for CLI execution.
- Passes package and certificate parameters through argument arrays.
- Retains display-only command logging.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Build Metrics ReportBinary Sizes
Test Results✅ 4549 passed, 5 skipped out of 4554 tests in 608.6s (+81.0s vs. baseline) Test Coverage✅ 89.1% line coverage, 82.4% branch coverage · ✅ no change vs. baseline CLI Startup Time49ms median (x64, Try This BuildInstalls the MSIX for your architecture, replacing any previously installed build. Needs the GitHub CLI — the command offers to install it and sign you in if it is missing. & ([scriptblock]::Create((irm https://raw.githubusercontent.com/microsoft/winappCli/main/scripts/winapp-pr.ps1))) 725Switching between builds often?Put the tool on your PATH once: & ([scriptblock]::Create((irm https://raw.githubusercontent.com/microsoft/winappCli/main/scripts/winapp-pr.ps1))) -AddToPathThen this build is just: winapp-pr 725Run Updated 2026-08-11 20:42:03 UTC · commit |
What
The four CLI invocations in
scripts/package-msix.ps1built a command string by interpolation and then executed it throughInvoke-Expression:Layout paths, package names, and the certificate path all flowed into that string. Any character with meaning to the PowerShell parser — a quote, semicolon, or ampersand in a path — would be re-interpreted as syntax instead of being passed through as data.
How
Use the call operator with an argument array and splat it:
$CertParam(previously the pre-quoted string--cert "path") becomes$CertArgs, a proper array, so the certificate path arrives as a discrete argument rather than a fragment of a larger string that gets re-parsed.The
Write-Hostcommand echoes are kept so build logs still show what ran, but they are now display-only and never executed.Validation
.\scripts\build-cli.ps1 -SkipTests -SkipNpmruns clean end to end through the full MSIX path — build-tools update, both architecture layouts, and both packages created and signed:No behavior change is intended; this is purely how the arguments reach the CLI.