php / pie

The PHP Installer for Extensions
BSD 3-Clause "New" or "Revised" License
630 stars 18 forks source link

Remove `escapeshellarg()` quoting for configure flags #94

Closed TimWolla closed 1 week ago

TimWolla commented 1 week ago

This quoting is not necessary and in fact actively harmful, because the ./configure command is not passed to a shell as a string where word-splitting happens, but as an argv array which the process will use as-is.

As an example, previously providing the --with-library=/tmp/foo flag would result in the --with-library='/tmp/foo' flag being passed as the argument, which then would be interpreted as if "--with-library='/tmp/foo'" was entered into a shell. In other words: The library was expected to be found in a directory literally starting with a single-quote.

asgrim commented 1 week ago

Thanks @TimWolla !