Skip to content

Incorrectly parsed arguments from signWithParams #45

Open
@ShGKme

Description

@ShGKme

Problem

When additional arguments are passed via signWithParams, they are parsed into arguments using RegExp.

// Split up at spaces and doublequotes
extraArgs.push(...options.signWithParams.match(/(?:[^\s"]+|"[^"]*")+/g) as Array<string>);
}

For example, signWithParams: '/n "My Awesome Company"' is parsed into ['/n', '"My Awesome Company"']. Double quotes are kept in place as the arg value. Then it's passed into signtool via Node.js fork, it's passed as an argument.

As a result, signtool receives value with double quotes "My Awesome Company" instead of the actual value My Awesome Company.

Same problem with device tokens and /csp, /kc params.

Proposals

1. Don't parse signWithParams

Currently params from the result of parsing are never used individually.

extraArgs.push(options.signWithParams)

2. Parse params with values

extraArgs.push(...[...options.signWithParams.matchAll(/(?:([^\s"]+)|"([^"]*)")+/g)].map((matched) => matched[1] || matched[2]));

Then it results into ['/n', 'My Awesome Company'] instead of ['/n', '"My Awesome Company"']

3. use windowsVerbatimArguments: true and quote other params instead

Solve the problem the other way around — quote args provided from @electron/windows-sign.


I'd prefer option 2, as it allows fixing another issue.

I'm ready to prove a PR, if that's ok.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions