src: fix escaping of single quotes in task runner

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #64089
Refs: https://hackerone.com/reports/3817602
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Author: aduh95

src/node_task_runner.cc

@@ -171,10 +171,10 @@ std::string EscapeShell(const std::string_view input) {
   escaped = std::regex_replace(escaped, leadingQuotePairs, "");
   escaped = std::regex_replace(escaped, tripleSingleQuote, "\\\"");
 #else
-  // Replace single quotes("'") with "\\'" and wrap the result
+  // Replace single quotes("'") with `'"'"'` and wrap the result
   // in single quotes.
   std::string escaped =
-      std::regex_replace(std::string(input), std::regex("'"), "\\'");
+      std::regex_replace(std::string(input), std::regex("'"), "'\"'\"'");
   escaped = "'" + escaped + "'";
   // Remove excessive quote pairs and handle edge cases
   static const std::regex tripleSingleQuote("\\\\'''");

test/cctest/test_node_task_runner.cc

@@ -28,12 +28,12 @@ TEST_F(TaskRunnerTest, EscapeShell) {
       {"test words", "'test words'"},
       {"$1", "'$1'"},
       {"\"$1\"", "'\"$1\"'"},
-      {"'$1'", "'\\'$1\\''"},
+      {"'$1'", "\"'\"'$1'\"'\"''"},
       {"\\$1", "'\\$1'"},
       {"--arg=\"$1\"", "'--arg=\"$1\"'"},
       {"--arg=node exec -c \"$1\"", "'--arg=node exec -c \"$1\"'"},
-      {"--arg=node exec -c '$1'", "'--arg=node exec -c \\'$1\\''"},
-      {"'--arg=node exec -c \"$1\"'", "'\\'--arg=node exec -c \"$1\"\\''"}
+      {"--arg=node exec -c '$1'", "'--arg=node exec -c '\"'\"'$1'\"'\"''"},
+      {"'--arg=node exec -c \"$1\"'", "\"'\"'--arg=node exec -c \"$1\"'\"'\"''"}
 #endif
   };
 

test/fixtures/run-script/node_modules/.bin/positional-args

@@ -143,15 +143,15 @@ describe('node --run [command]', () => {
   it('appends positional arguments', async () => {
     const child = await common.spawnPromisified(
       process.execPath,
-      [ '--run', `positional-args${envSuffix}`, '--', '--help "hello world test"', 'A', 'B', 'C'],
+      [ '--run', `positional-args${envSuffix}`, '--', '--help "hello world test"', 'A', 'B', 'C', 'I think therefore I\'m'],
       { cwd: fixtures.path('run-script') },
     );
     if (common.isWindows) {
-      assert.match(child.stdout, /Arguments: '--help ""hello world test"" A B C'/);
+      assert.match(child.stdout, /Arguments: '--help ""hello world test"" A B C I think therefore I'm'/);
     } else {
-      assert.match(child.stdout, /Arguments: '--help "hello world test" A B C'/);
+      assert.match(child.stdout, /Arguments: '--help "hello world test" A B C I think therefore I'm'/);
     }
-    assert.match(child.stdout, /The total number of arguments are: 4/);
+    assert.match(child.stdout, /The total number of arguments is: 5/);
     assert.strictEqual(child.stderr, '');
     assert.strictEqual(child.code, 0);
   });