The options need to be escaped separately

cweagans#401
wearerequired · May 10, 2022 · d1a08bd · d1a08bd
1 parent 55c4289
commit d1a08bd
Showing 1 changed file with 10 additions and 2 deletions.
diff --git a/src/Plugin/Patches.php b/src/Plugin/Patches.php
@@ -443,7 +443,7 @@ protected function getAndApplyPatch(RemoteFilesystem $downloader, $install_path,
             // differences between how patch works on windows and unix.
             $patch_options = '--no-backup-if-mismatch';
             if (PHP_OS_FAMILY == 'BSD') {
-                $patch_options = '--posix --batch';
+                $patch_options = ['--posix', '--batch'];
             }
             foreach ($patch_levels as $patch_level) {
                 if ($patched = $this->executeCommand(
@@ -502,7 +502,15 @@ protected function executeCommand($cmd)
         // Shell-escape all arguments except the command.
         $args = func_get_args();
         foreach ($args as $index => $arg) {
-            if ($index !== 0) {
+            if ($index === 0) {
+                continue;
+            }
+            if (is_array($arg)) {
+                $args[$index] = '';
+                foreach ($arg as $option) {
+                    $args[$index] .= ' ' . escapeshellarg($option);
+                }
+            } else {
                 $args[$index] = escapeshellarg($arg);
             }
         }