-
-
Notifications
You must be signed in to change notification settings - Fork 9.8k
Description
Symfony version(s) affected
5.4+
Description
You can see that the ExecutableFinder if it cannot find an executable by itself in the PATH will then refer to there where command here
symfony/src/Symfony/Component/Process/ExecutableFinder.php
Lines 89 to 94 in 839a02b
| $command = '\\' === \DIRECTORY_SEPARATOR ? 'where %s 2> NUL' : 'command -v -- %s'; | |
| $execResult = exec(\sprintf($command, escapeshellarg($name))); | |
| if (($executablePath = substr($execResult, 0, strpos($execResult, \PHP_EOL) ?: null)) && @is_executable($executablePath)) { | |
| return $executablePath; | |
| } |
However this has a few problems:
-
This searches in current directory, per the command's description:
By default, the search is done along the current directory and in the paths specified by the PATH environment variable.
This is perhaps ok as a fallback if no real executable exists... BUT:
-
This does not find built-in commands like rmdir, copy and others which means it might revert to using a local rmdir.exe when used to make [Process] On Windows, don't rely on the OS to find executables #58710 - I worked around this in the Composer PR here but this is not an exhaustive list of built-in commands, just a list of common ones I found by playing with
whereand seeing which it could find and not (for built-in ones it errors and does not find an exe, unless you have an exe in CWD). If someone knows where to find a complete list of built-in commands that might be valuable (cc @johnstevenson here too sorry :D) -
if using
wherewe should ensure that the error output is caught, right now ExecutableFinder callswhereusing a plainexec()call which leaks errors to stderr, e.g.(new Symfony\Component\Process\ExecutableFinder())->find('lala');outputsINFO: Could not find files for the given pattern(s).to stderr. (found this here)
So I think in ExecutableFinder it might be ok to keep as is, I'm mostly opening this issue to document my findings.. But in the context of #58710 it's wrong for built-ins, and maybe built-ins should be added to ExecutableFinder so that it can just "find" these as e.g. rmdir => rmdir and not transform these in any way.
How to reproduce
above
Possible Solution
No response
Additional Context
No response