From dfc960de2a3eb199b2ece8eab55c91129bef8607 Mon Sep 17 00:00:00 2001 From: Lin Junrong Date: Mon, 27 Jul 2026 15:55:54 +0800 Subject: [PATCH] fix(tests): use string form for shell=True subprocess.run in nodejs test start scripts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Windows-only start scripts under tests/ten_runtime/integration/nodejs/standalone_test_nodejs_{2,3} pass a list argument together with shell=True: subprocess.run(["npm", "install"], env=env, shell=True) Python's subprocess docs advise against this combination. On POSIX, /bin/sh -c npm install runs sh with cmd="npm" and $0="install", so npm executes with no arguments and silently no-ops. On Windows, subprocess joins the list via list2cmdline before running through cmd.exe, so the call happens to work — but only by accident of that particular platform's shell. Switch to the documented string form for shell=True. Behavior is identical on Windows (list2cmdline of ["npm","install"] is already "npm install") and is correct on POSIX (someone running this Python fallback from a Unix shell now actually invokes npm install). Same file, line 53 of standalone_test_nodejs_3 already uses shell=False with a list ('subprocess.run(["node", "--expose-gc", "build/index.js"], env=env)'), which is the pattern for list arguments — so the shell=True in the other call sites is the copy-paste anomaly. Follows the general subprocess hardening thread in #2240. --- .../default_extension_nodejs/tests/bin/start.py | 6 +++--- .../default_extension_nodejs/tests/bin/start.py | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/ten_runtime/integration/nodejs/standalone_test_nodejs_2/default_extension_nodejs/tests/bin/start.py b/tests/ten_runtime/integration/nodejs/standalone_test_nodejs_2/default_extension_nodejs/tests/bin/start.py index 1e4049a48d..1d6de94ba7 100644 --- a/tests/ten_runtime/integration/nodejs/standalone_test_nodejs_2/default_extension_nodejs/tests/bin/start.py +++ b/tests/ten_runtime/integration/nodejs/standalone_test_nodejs_2/default_extension_nodejs/tests/bin/start.py @@ -16,14 +16,14 @@ # npm install print("Running npm install...") -result = subprocess.run(["npm", "install"], env=env, shell=True) +result = subprocess.run("npm install", env=env, shell=True) if result.returncode != 0: print("npm install failed") sys.exit(result.returncode) # npm run build print("Running npm run build...") -result = subprocess.run(["npm", "run", "build"], env=env, shell=True) +result = subprocess.run("npm run build", env=env, shell=True) if result.returncode != 0: print("npm run build failed") sys.exit(result.returncode) @@ -50,5 +50,5 @@ # npm test print("Running npm test...") -result = subprocess.run(["npm", "test"], env=env, shell=True) +result = subprocess.run("npm test", env=env, shell=True) sys.exit(result.returncode) diff --git a/tests/ten_runtime/integration/nodejs/standalone_test_nodejs_3/default_extension_nodejs/tests/bin/start.py b/tests/ten_runtime/integration/nodejs/standalone_test_nodejs_3/default_extension_nodejs/tests/bin/start.py index 22e4fb9b85..4e0f5c5e74 100644 --- a/tests/ten_runtime/integration/nodejs/standalone_test_nodejs_3/default_extension_nodejs/tests/bin/start.py +++ b/tests/ten_runtime/integration/nodejs/standalone_test_nodejs_3/default_extension_nodejs/tests/bin/start.py @@ -16,14 +16,14 @@ # npm install print("Running npm install...") -result = subprocess.run(["npm", "install"], env=env, shell=True) +result = subprocess.run("npm install", env=env, shell=True) if result.returncode != 0: print("npm install failed") sys.exit(result.returncode) # npm run build print("Running npm run build...") -result = subprocess.run(["npm", "run", "build"], env=env, shell=True) +result = subprocess.run("npm run build", env=env, shell=True) if result.returncode != 0: print("npm run build failed") sys.exit(result.returncode)