Fix executeHooks to quote args for shell command (#8383)

Author: vhenzl

.changeset/brave-cameras-call.md

@@ -0,0 +1,5 @@
+---
+"@graphql-codegen/cli": patch
+---
+
+Fix `executeHooks` to quote args for shell command

packages/graphql-codegen-cli/package.json

@@ -70,6 +70,7 @@
  "listr2": "^4.0.5",
  "log-symbols": "^4.0.0",
  "mkdirp": "^1.0.4",
+ "shell-quote": "^1.7.3",
  "string-env-interpolation": "^1.0.1",
  "ts-log": "^2.2.3",
  "tslib": "^2.4.0",
@@ -83,6 +84,7 @@
  "@types/is-glob": "4.0.2",
  "@types/js-yaml": "4.0.5",
  "@types/mkdirp": "1.0.2",
+ "@types/shell-quote": "^1.7.1",
  "bdd-stdin": "0.2.0",
  "change-case-all": "1.0.14",
  "js-yaml": "4.1.0",

packages/graphql-codegen-cli/src/hooks.ts

@@ -2,6 +2,7 @@ import { Types } from '@graphql-codegen/plugin-helpers';
 import { debugLog } from './utils/debugging.js';
 import { exec } from 'child_process';
 import { delimiter, sep } from 'path';
+import { quote } from 'shell-quote';
 
 const DEFAULT_HOOKS: Types.LifecycleHooksDefinition<string[]> = {
  afterStart: [],
@@ -76,10 +77,11 @@ async function executeHooks(
 ): Promise<void> {
  debugLog(`Running lifecycle hook "${hookName}" scripts...`);
 
+ const quotedArgs = quote(args);
  for (const script of scripts) {
  if (typeof script === 'string') {
- debugLog(`Running lifecycle hook "${hookName}" script: ${script} with args: ${args.join(' ')}...`);
- await execShellCommand(`${script} ${args.join(' ')}`);
+ debugLog(`Running lifecycle hook "${hookName}" script: ${script} with args: ${quotedArgs}...`);
+ await execShellCommand(`${script} ${quotedArgs}`);
  } else {
  debugLog(`Running lifecycle hook "${hookName}" script: ${script.name} with args: ${args.join(' ')}...`);
  await script(...args);
@@ -94,7 +96,7 @@ export const lifecycleHooks = (_hooks: Partial<Types.LifecycleHooksDefinition> =
  afterStart: async (): Promise<void> => executeHooks('afterStart', hooks.afterStart),
  onWatchTriggered: async (event: string, path: string): Promise<void> =>
  executeHooks('onWatchTriggered', hooks.onWatchTriggered, [event, path]),
- onError: async (error: string): Promise<void> => executeHooks('onError', hooks.onError, [`"${error}"`]),
+ onError: async (error: string): Promise<void> => executeHooks('onError', hooks.onError, [error]),
  afterOneFileWrite: async (path: string): Promise<void> =>
  executeHooks('afterOneFileWrite', hooks.afterOneFileWrite, [path]),
  afterAllFileWrite: async (paths: string[]): Promise<void> =>

yarn.lock

@@ -3558,6 +3558,11 @@
  "@types/mime" "^1"
  "@types/node" "*"
 
+"@types/shell-quote@^1.7.1":
+ version "1.7.1"
+ resolved "https://registry.yarnpkg.com/@types/shell-quote/-/shell-quote-1.7.1.tgz#2d059091214a02c29f003f591032172b2aff77e8"
+ integrity sha512-SWZ2Nom1pkyXCDohRSrkSKvDh8QOG9RfAsrt5/NsPQC4UQJ55eG0qClA40I+Gkez4KTQ0uDUT8ELRXThf3J5jw==
+
 "@types/stack-utils@^2.0.0":
  version "2.0.1"
  resolved "https://registry.yarnpkg.com/@types/stack-utils/-/stack-utils-2.0.1.tgz#20f18294f797f2209b5f65c8e3b5c8e8261d127c"
@@ -11925,6 +11930,11 @@ shebang-regex@^3.0.0:
  resolved "https://registry.yarnpkg.com/shebang-regex/-/shebang-regex-3.0.0.tgz#ae16f1644d873ecad843b0307b143362d4c42172"
  integrity sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==
 
+shell-quote@^1.7.3:
+ version "1.7.3"
+ resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.7.3.tgz#aa40edac170445b9a431e17bb62c0b881b9c4123"
+ integrity sha512-Vpfqwm4EnqGdlsBFNmHhxhElJYrdfcxPThu+ryKS5J8L/fhAwLazFZtq+S+TWZ9ANj2piSQLGj6NQg+lKPmxrw==
+
 shiki@0.10.1:
  version "0.10.1"
  resolved "https://registry.yarnpkg.com/shiki/-/shiki-0.10.1.tgz#6f9a16205a823b56c072d0f1a0bcd0f2646bef14"