From cdb4d00bf2a3b0ea1c8e6ec8f79111b1853fc08a Mon Sep 17 00:00:00 2001
From: DongZifan <169039417+DongZifan@users.noreply.github.com>
Date: Mon, 20 Apr 2026 20:43:39 +0800
Subject: [PATCH 1/3] Change shell option to false in async functions

---
 build/src/utils/async.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/build/src/utils/async.js b/build/src/utils/async.js
index 706b58d3fd..2588dfe625 100644
--- a/build/src/utils/async.js
+++ b/build/src/utils/async.js
@@ -25,7 +25,7 @@ module.exports = {
     spawn: async (command, args, opts) => {
         console.log(`(*) Spawn: ${command}${args.reduce((prev, current) => `${prev} ${current}`, '')}`);
 
-        opts = opts || { stdio: 'inherit', shell: true };
+        opts = opts || { stdio: 'inherit', shell: false };
         let echo = false;
         if (opts.stdio === 'inherit') {
             opts.stdio = 'pipe';
@@ -73,7 +73,7 @@ module.exports = {
     exec: async (command, opts) => {
         console.log(`(*) Exec: ${command}`);
 
-        opts = opts || { stdio: 'inherit', shell: true };
+        opts = opts || { stdio: 'inherit', shell: false };
         return new Promise((resolve, reject) => {
             let result = '';
             const proc = execCb(command, opts);

From 7f3fecfd4363a7884752e0b7dd21209b2c3d87d6 Mon Sep 17 00:00:00 2001
From: DongZifan <169039417+DongZifan@users.noreply.github.com>
Date: Thu, 14 May 2026 20:46:12 +0800
Subject: [PATCH 2/3] Update async.js

---
 build/src/utils/async.js | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/build/src/utils/async.js b/build/src/utils/async.js
index 2588dfe625..207b31ab3e 100644
--- a/build/src/utils/async.js
+++ b/build/src/utils/async.js
@@ -10,7 +10,7 @@ const rimrafCb = require('rimraf');
 const mkdirpCb = require('mkdirp');
 const copyFilesCb = require('copyfiles');
 const spawnCb = require('child_process').spawn;
-const execCb = require('child_process').exec;
+const execFileCb = require('child_process').execFile;
 
 module.exports = {
 
@@ -25,7 +25,9 @@ module.exports = {
     spawn: async (command, args, opts) => {
         console.log(`(*) Spawn: ${command}${args.reduce((prev, current) => `${prev} ${current}`, '')}`);
 
-        opts = opts || { stdio: 'inherit', shell: false };
+        opts = Object.assign({}, opts || { stdio: 'inherit' });
+        opts.shell = false;
+    
         let echo = false;
         if (opts.stdio === 'inherit') {
             opts.stdio = 'pipe';
@@ -73,10 +75,16 @@ module.exports = {
     exec: async (command, opts) => {
         console.log(`(*) Exec: ${command}`);
 
-        opts = opts || { stdio: 'inherit', shell: false };
+        opts = Object.assign({}, opts || { stdio: 'inherit' });
+        opts.shell = false;
+
+        const parts = command.trim().split(/\s+/);
+        const file = parts[0];
+        const args = parts.slice(1);
+
         return new Promise((resolve, reject) => {
             let result = '';
-            const proc = execCb(command, opts);
+            const proc = execFileCb(file, args, opts);
             proc.on('close', (code, signal) => {
                 if (code !== 0) {
                     console.log(result);
@@ -211,4 +219,3 @@ module.exports = {
         });
     }
 };
-

From 6734563827b1c42032c6ea9c8aaf42a4dd67b753 Mon Sep 17 00:00:00 2001
From: DongZifan <169039417+DongZifan@users.noreply.github.com>
Date: Fri, 31 Jul 2026 10:36:26 +0800
Subject: [PATCH 3/3] Fix: safe shell defaults and exec(file, args) API

---
 build/src/utils/async.js | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/build/src/utils/async.js b/build/src/utils/async.js
index 207b31ab3e..f46216be53 100644
--- a/build/src/utils/async.js
+++ b/build/src/utils/async.js
@@ -10,6 +10,7 @@ const rimrafCb = require('rimraf');
 const mkdirpCb = require('mkdirp');
 const copyFilesCb = require('copyfiles');
 const spawnCb = require('child_process').spawn;
+const execCb = require('child_process').exec;
 const execFileCb = require('child_process').execFile;
 
 module.exports = {
@@ -26,7 +27,9 @@ module.exports = {
         console.log(`(*) Spawn: ${command}${args.reduce((prev, current) => `${prev} ${current}`, '')}`);
 
         opts = Object.assign({}, opts || { stdio: 'inherit' });
-        opts.shell = false;
+        if (opts.shell === undefined) {
+            opts.shell = false;
+        }
     
         let echo = false;
         if (opts.stdio === 'inherit') {
@@ -72,19 +75,27 @@ module.exports = {
         });
     },
 
-    exec: async (command, opts) => {
-        console.log(`(*) Exec: ${command}`);
+    exec: async (file, args, opts) => {
+        console.log(`(*) Exec: ${file} ${args.join(' ')}`);
 
         opts = Object.assign({}, opts || { stdio: 'inherit' });
-        opts.shell = false;
+        if (opts.shell === undefined) {
+            opts.shell = false;
+        }
 
-        const parts = command.trim().split(/\s+/);
-        const file = parts[0];
-        const args = parts.slice(1);
+        let proc;
+        if (opts.shell) {
+            // Explicit shell opt-in: reconstruct command string for exec
+            const command = [file, ...args].join(' ');
+            proc = execCb(command, opts);
+        } else {
+            // Default safe path: execFile directly (no shell, no string parsing)
+            proc = execFileCb(file, args, opts);
+        }
 
         return new Promise((resolve, reject) => {
             let result = '';
-            const proc = execFileCb(file, args, opts);
+            // proc already created above
             proc.on('close', (code, signal) => {
                 if (code !== 0) {
                     console.log(result);