fix: encode PowerShell scripts across the Windows shell boundary

Preserve UTF-8 paths and exit status through GopherLua and cmd.exe without nested command quotes.

Fixes version-fox/vfox#685

Author: aooohan

lib/windows_command.lua

@@ -1,21 +1,40 @@
 local command = {}
 
--- os.execute/io.popen pass through cmd.exe before PowerShell. Do not expose
--- percent expansion, delayed expansion, or quotes to that outer parser.
+local alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
+local function base64(value)
+    local result = {}
+    for i = 1, #value, 3 do
+        local a, b, c = value:byte(i, i + 2)
+        local number = a * 65536 + (b or 0) * 256 + (c or 0)
+        local first = math.floor(number / 262144) + 1
+        local second = math.floor(number / 4096) % 64 + 1
+        local third = math.floor(number / 64) % 64 + 1
+        local fourth = number % 64 + 1
+        result[#result + 1] = alphabet:sub(first, first) .. alphabet:sub(second, second) ..
+            (b and alphabet:sub(third, third) or '=') ..
+            (c and alphabet:sub(fourth, fourth) or '=')
+    end
+    return table.concat(result)
+end
+
+-- Encode UTF-8 values separately so even non-ASCII paths produce an ASCII
+-- PowerShell script, without exposing arguments to either shell's parser.
 local function literal(value)
     if value:find('[\r\n%z]') then
         error('Windows command argument contains a control character')
     end
-    value = value:gsub("'", "''")
-    value = value:gsub('[%%!\"]', function(char)
-        return "' + [char]" .. string.byte(char) .. " + '"
-    end)
-    return "('" .. value .. "')"
+    return "([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" .. base64(value) .. "')))"
 end
 
 local function powershell(script)
-    return 'powershell -NoProfile -NonInteractive -Command "' ..
-        "$ErrorActionPreference = 'Stop'; " .. script .. '"'
+    script = "$ErrorActionPreference = 'Stop'; " .. script
+    -- GopherLua launches cmd.exe /c, which reinterprets a quoted -Command.
+    -- -EncodedCommand takes UTF-16LE base64 with no quotes or metacharacters.
+    local utf16 = script:gsub('.', function(char)
+        assert(char:byte() < 128, 'PowerShell script must contain only ASCII')
+        return char .. '\0'
+    end)
+    return 'powershell -NoProfile -NonInteractive -EncodedCommand ' .. base64(utf16)
 end
 
 function command.native(program, args)

tests/windows_install_test.lua

@@ -11,11 +11,47 @@ package.preload.http = function() return {download_file = function() return nil
 package.preload.html = function() return {} end
 package.preload.json = function() return {} end
 local oldExecute, oldPopen, oldOpen, oldClose, oldRemove = os.execute, io.popen, io.open, io.close, os.remove
+
+-- Decode the command independently so the test inspects what PowerShell will
+-- execute, rather than only checking a command string prefix.
+local alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
+local function decodeBase64(value)
+    local result, accumulator, bits = {}, 0, 0
+    for char in value:gmatch('.') do
+        if char == '=' then break end
+        local index = assert(alphabet:find(char, 1, true), 'invalid base64') - 1
+        accumulator = accumulator * 64 + index
+        bits = bits + 6
+        if bits >= 8 then
+            bits = bits - 8
+            local scale = 2 ^ bits
+            result[#result + 1] = string.char(math.floor(accumulator / scale))
+            accumulator = accumulator % scale
+        end
+    end
+    return table.concat(result)
+end
+local function decodeCommand(value)
+    local payload = assert(value:match('^powershell %-NoProfile %-NonInteractive %-EncodedCommand ([A-Za-z0-9+/=]+)$'),
+        'PowerShell command must contain only an unquoted base64 payload: ' .. value)
+    local utf16 = decodeBase64(payload)
+    assert(#utf16 % 2 == 0, 'incomplete UTF-16LE code unit')
+    local bytes = {}
+    for i = 1, #utf16, 2 do
+        assert(utf16:byte(i) < 128 and utf16:byte(i + 1) == 0, 'script must use ASCII UTF-16LE')
+        bytes[#bytes + 1] = utf16:sub(i, i)
+    end
+    local script = table.concat(bytes)
+    assert(script:find("$ErrorActionPreference = 'Stop'; ", 1, true) == 1, 'error preference must execute')
+    return script
+end
+
 os.execute = function(command)
     state.commands[#state.commands + 1] = command
     -- Native paths must never be expanded as cmd variables or tokenized on spaces.
     assert(command:find('powershell ', 1, true), 'unquoted Windows command: ' .. command)
     assert(not command:find('%%') and not command:find('!'), 'cmd expansion in command: ' .. command)
+    decodeCommand(command)
     return #state.commands == state.failOn and 1 or 0
 end
 io.popen = function(command)
@@ -74,6 +110,19 @@ for _, failure in ipairs({
     assert(#state.commands == 2, failure.name .. ': no MSI or pip may run before enumeration succeeds')
 end
 local windows = require('windows_command')
+for _, value in ipairs({'', 'f', 'fo', 'foo', 'foob', 'fooba', 'foobar', "C:\\用户\\Mechael's & %USERNAME% !\\", 'quotes"stay data'}) do
+    local script = decodeCommand(windows.native('program.exe', {value}))
+    local arguments = {}
+    for encoded in script:gmatch("FromBase64String%('([A-Za-z0-9+/=]*)'%)") do
+        arguments[#arguments + 1] = decodeBase64(encoded)
+    end
+    assert(#arguments == 2 and arguments[1] == 'program.exe' and arguments[2] == value,
+        'native argument changed after payload decoding')
+    assert(script:find('; exit $LASTEXITCODE', 1, true), 'native exit status must propagate')
+end
+local msi = decodeCommand(windows.msi('C:\\MSI files\\core.msi', path))
+assert(msi:find('Start-Process -FilePath msiexec.exe -Wait -PassThru', 1, true))
+assert(msi:find('; exit $process.ExitCode', 1, true))
 assert(not pcall(windows.msi, 'C:\\bad"path\\python.msi', path), 'invalid Windows quote must fail')
 assert(not pcall(windows.native, 'bad\nprogram', {}), 'control characters must fail')
 os.execute, io.popen, io.open, io.close, os.remove = oldExecute, oldPopen, oldOpen, oldClose, oldRemove