From 4b055f55e1836b1b903c08b31071f00c39a81d4b Mon Sep 17 00:00:00 2001
From: Long Zheng <long.zheng@gmail.com>
Date: Wed, 1 May 2024 04:11:58 +1000
Subject: [PATCH] server/cli: Fix Node 20.12.2 child_process.spawn .cmd EINVAL
 on Windows (#1455)

* Fix spawning .cmd on Windows

* Fix comment

* Fix quotes

* Fix quotes

* Fix quotes (really)

* Simplify variable
---
 install/local/install-scrypted-dependencies-win.ps1 | 7 +++++--
 packages/cli/src/service.ts                         | 2 ++
 server/src/plugin/plugin-npm-dependencies.ts        | 2 ++
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/install/local/install-scrypted-dependencies-win.ps1 b/install/local/install-scrypted-dependencies-win.ps1
index 2895e5afc..b9c8bfa7b 100644
--- a/install/local/install-scrypted-dependencies-win.ps1
+++ b/install/local/install-scrypted-dependencies-win.ps1
@@ -34,7 +34,8 @@ $SCRYPTED_HOME_ESCAPED_PATH = $SCRYPTED_HOME.replace('\', '\\')
 npm install --prefix $SCRYPTED_HOME @koush/node-windows --save
 
 $NPX_PATH = (Get-Command npx).Path
-$NPX_PATH_ESCAPED = $NPX_PATH.replace('\', '\\')
+# The path needs double quotes to handle spaces in the directory path
+$NPX_PATH_ESCAPED = '"' + $NPX_PATH.replace('\', '\\') + '"'
 
 $SERVICE_JS = @"
 const fs = require('fs');
@@ -44,8 +45,10 @@ try {
 catch (e) {
 }
 const child_process = require('child_process');
-child_process.spawn('$($NPX_PATH_ESCAPED)', ['-y', 'scrypted', 'serve'], {
+child_process.spawn('$NPX_PATH_ESCAPED', ['-y', 'scrypted', 'serve'], {
     stdio: 'inherit',
+    // allow spawning .cmd https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+    shell: true,
 });
 "@
 
diff --git a/packages/cli/src/service.ts b/packages/cli/src/service.ts
index 295152756..e6d325770 100644
--- a/packages/cli/src/service.ts
+++ b/packages/cli/src/service.ts
@@ -24,6 +24,8 @@ async function runCommand(command: string, ...args: string[]) {
             // https://github.com/lovell/sharp/blob/eefaa998725cf345227d94b40615e090495c6d09/lib/libvips.js#L115C19-L115C46
             SHARP_IGNORE_GLOBAL_LIBVIPS: 'true',
         },
+        // allow spawning .cmd https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+        shell: os.platform() === 'win32' ? true : undefined,
     });
     await once(cp, 'exit');
     if (cp.exitCode)
diff --git a/server/src/plugin/plugin-npm-dependencies.ts b/server/src/plugin/plugin-npm-dependencies.ts
index 1790d28f7..c51db4c26 100644
--- a/server/src/plugin/plugin-npm-dependencies.ts
+++ b/server/src/plugin/plugin-npm-dependencies.ts
@@ -72,6 +72,8 @@ export async function installOptionalDependencies(console: Console, packageJson:
         const cp = npmExecFunction(['--prefix', nodePrefix, 'install'], {
             cwd: nodePrefix,
             stdio: 'inherit',
+            // allow spawning .cmd https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+            shell: os.platform() === 'win32' ? true : undefined,
         });
 
         await once(cp, 'exit');