dotnet/msbuild

Provide a method to execute an external command without using a shell

Open

#399 opened on Dec 10, 2015

View on GitHub
 (6 comments) (3 reactions) (0 assignees)C# (1,364 forks)batch import
help wantedneeds-designtriaged

Repository metrics

Stars
 (5,062 stars)
PR merge metrics
 (Avg merge 11d 7h) (125 merged PRs in 30d)

Description

The Exec task always spawns a shell to invoke the external command. This is convenient, but non-portable, insecure (though not exploitable here), and requires non-portable escaping.

A better solution is to provide a way to execute an external command without using a shell. It should have the following properties:

  • Lists are respected.
  • Any character can be passed to an external command. No manual escaping required.
  • Special characters in property values do not cause problems.
  • No shell is invoked, unless the external command is the shell.
  • It should be possible to pass multiple arguments to the shell
  • The syntax should be something other than requiring a seperate XML element per argument.

Contributor guide

Research direction
Investigate the current Exec task implementation in MSBuild source code, understand how MSBuild executes tasks with shell invocation, and design a new method (e.g., a new task or extended syntax) that allows executing commands without a shell, supporting lists and avoiding escaping issues. Consider patterns like using an array of arguments instead of a command string.
Tech stack
csharp
Domain
build system
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
C#
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40