Merge remote-tracking branch 'upstream/main' into RTECO-1574

Author: bhanurp

build/gradle.go

@@ -10,6 +10,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"runtime"
 	"strings"
 
 	"github.com/jfrog/build-info-go/utils"
@@ -260,41 +261,72 @@ func (config *gradleRunConfig) GetCmd() *exec.Cmd {
 	}
 	// Add BUILDINFO_PROPFILE system property if extractor properties file exists
 	if config.extractorPropsFile != "" {
-		jvmProp := fmt.Sprintf("-D%s=%s", extractorPropsDir, config.extractorPropsFile)
-		if strings.Contains(config.extractorPropsFile, " ") {
-			jvmProp = fmt.Sprintf("-D%s='%s'", extractorPropsDir, config.extractorPropsFile)
-		}
-		cmd = append(cmd, jvmProp)
+		cmd = append(cmd, fmt.Sprintf("-D%s=%s", extractorPropsDir, config.extractorPropsFile))
 	}
-	cmd = append(cmd, formatCommandProperties(config.tasks)...)
-	config.logger.Info("Running gradle command:", strings.Join(cmd, " "))
+	cmd = append(cmd, stripPropertyQuotes(config.tasks)...)
+	config.logger.Info("Running gradle command:", strings.Join(quoteArgsForLog(cmd), " "))
 	return exec.Command(cmd[0], cmd[1:]...)
 }
 
-func formatCommandProperties(tasks []string) []string {
-	var cmdArgs []string
-	for _, task := range tasks {
+// stripPropertyQuotes removes a matching pair of leading/trailing quote characters (' or ") from system/project
+// property values, e.g., -Dkey='val ue' => -Dkey=val ue.
+// This is only needed on Windows: cmd.exe and PowerShell don't strip single quotes from arguments the way
+// bash/zsh do, so a value quoted on the command line can still reach this process with the quotes literally
+// part of the string. Left as-is, they'd be passed straight through to Gradle, and end up uploaded to
+// Artifactory as part of the value. On other platforms the shell has already stripped shell-level quoting by
+// the time this process sees the argument, so any quotes still present were typed deliberately as part of the
+// value and must be left alone.
+func stripPropertyQuotes(tasks []string) []string {
+	if runtime.GOOS != "windows" {
+		return tasks
+	}
+	strippedTasks := make([]string, len(tasks))
+	for i, task := range tasks {
 		if isSystemOrProjectProperty(task) {
-			task = quotePropertyIfNeeded(task)
+			task = unquoteProperty(task)
 		}
-		cmdArgs = append(cmdArgs, task)
+		strippedTasks[i] = task
+	}
+	return strippedTasks
+}
+
+// Strips a matching pair of leading/trailing single or double quotes from a system or project property's value.
+func unquoteProperty(task string) string {
+	parts := strings.SplitN(task, "=", 2)
+	if len(parts) < 2 {
+		return task
 	}
-	return cmdArgs
+	return parts[0] + "=" + utils.StripSurroundingQuotes(parts[1])
+}
+
+// quoteArgsForLog returns a copy of args with system/project property values wrapped in quotes, e.g.,
+// -Dkey=val ue => -Dkey='val ue', purely to make the printed command's property boundaries unambiguous.
+// This must never be used to build the actual arguments passed to exec.Command: those are executed directly,
+// without going through a shell, so added quote characters would be passed through literally instead of being
+// stripped, corrupting the property value.
+func quoteArgsForLog(args []string) []string {
+	logArgs := make([]string, len(args))
+	for i, arg := range args {
+		if isSystemOrProjectProperty(arg) {
+			arg = quoteProperty(arg)
+		}
+		logArgs[i] = arg
+	}
+	return logArgs
 }
 
 func isSystemOrProjectProperty(task string) bool {
 	hasPropertiesFlag := strings.HasPrefix(task, systemPropertiesFlag) || strings.HasPrefix(task, projectPropertiesFlag)
 	return hasPropertiesFlag && strings.Contains(task, "=")
 }
 
-// Wraps system or project property value in quotes if its value contain spaces, e.g., -Dkey=val ue => -Dkey='val ue'
-func quotePropertyIfNeeded(task string) string {
+// Wraps a system or project property's value in quotes, e.g., -Dkey=val ue => -Dkey='val ue'
+func quoteProperty(task string) string {
 	parts := strings.SplitN(task, "=", 2)
-	if strings.Contains(parts[1], " ") {
-		return fmt.Sprintf(`%s='%s'`, parts[0], parts[1])
+	if len(parts) < 2 {
+		return task
 	}
-
-	return task
+	return fmt.Sprintf(`%s='%s'`, parts[0], parts[1])
 }
 
 func (config *gradleRunConfig) runCmd(stdout, stderr io.Writer) error {

build/gradle_test.go

@@ -3,6 +3,7 @@ package build
 import (
 	"fmt"
 	"path/filepath"
+	"runtime"
 	"testing"
 
 	"github.com/jfrog/build-info-go/utils"
@@ -103,31 +104,113 @@ func TestParseGradleVersion(t *testing.T) {
 	}
 }
 
-func TestFormatCommandProperties(t *testing.T) {
+func TestQuoteArgsForLog(t *testing.T) {
 	tests := []struct {
 		input    []string
 		expected []string
 	}{
 		{
 			input:    []string{"clean", "-Dparam=value", "build", "-Pkey=value"},
-			expected: []string{"clean", "-Dparam=value", "build", "-Pkey=value"},
+			expected: []string{"clean", "-Dparam='value'", "build", "-Pkey='value'"},
 		},
 		{
 			input:    []string{"-Dprop1=value1", "test", "-Pprop2=value2"},
-			expected: []string{"-Dprop1=value1", "test", "-Pprop2=value2"},
+			expected: []string{"-Dprop1='value1'", "test", "-Pprop2='value2'"},
 		},
 		{
 			input:    []string{"-Dparam1=value1 value2", "-Pkey1=value1", "-Dparam2=value2", "-Pkey2=value1 value2"},
-			expected: []string{"-Dparam1='value1 value2'", "-Pkey1=value1", "-Dparam2=value2", "-Pkey2='value1 value2'"},
+			expected: []string{"-Dparam1='value1 value2'", "-Pkey1='value1'", "-Dparam2='value2'", "-Pkey2='value1 value2'"},
 		},
 		{
 			input:    []string{"-Dparam1=value1", "run", "-Psign"},
-			expected: []string{"-Dparam1=value1", "run", "-Psign"},
+			expected: []string{"-Dparam1='value1'", "run", "-Psign"},
 		},
 	}
 
 	for _, test := range tests {
-		result := formatCommandProperties(test.input)
+		result := quoteArgsForLog(test.input)
 		assert.ElementsMatch(t, test.expected, result)
 	}
 }
+
+func TestUnquoteProperty(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{input: "-Dparam=value", expected: "-Dparam=value"},
+		{input: "-Ddeploy.test.property=test test", expected: "-Ddeploy.test.property=test test"},
+		{input: "-Ddeploy.test.property='test test'", expected: "-Ddeploy.test.property=test test"},
+		{input: `-Pkey="value with spaces"`, expected: "-Pkey=value with spaces"},
+		// Mismatched quote pair: left as-is.
+		{input: `-Dparam='value"`, expected: `-Dparam='value"`},
+		// No '=' at all: returned unchanged rather than panicking on the missing value part.
+		{input: "-Dparam", expected: "-Dparam"},
+	}
+
+	for _, test := range tests {
+		assert.Equal(t, test.expected, unquoteProperty(test.input))
+	}
+}
+
+func TestStripPropertyQuotes(t *testing.T) {
+	tests := []struct {
+		input    []string
+		expected []string
+	}{
+		{
+			input:    []string{"clean", "-Dparam=value", "build", "-Pkey=value"},
+			expected: []string{"clean", "-Dparam=value", "build", "-Pkey=value"},
+		},
+		{
+			// Quotes already stripped by the shell, value has no surrounding quotes: left as-is.
+			input:    []string{"-Ddeploy.test.property=test test"},
+			expected: []string{"-Ddeploy.test.property=test test"},
+		},
+		{
+			// Quotes still present in the raw arg (e.g. on Windows, where cmd.exe/PowerShell don't strip
+			// single quotes the way bash/zsh do): stripped only on Windows.
+			input:    []string{"-Ddeploy.test.property='test test'"},
+			expected: []string{"-Ddeploy.test.property=test test"},
+		},
+		{
+			input:    []string{`-Pkey="value with spaces"`},
+			expected: []string{"-Pkey=value with spaces"},
+		},
+		{
+			// Mismatched quote pair: left as-is.
+			input:    []string{`-Dparam='value"`},
+			expected: []string{`-Dparam='value"`},
+		},
+	}
+
+	for _, test := range tests {
+		result := stripPropertyQuotes(test.input)
+		if runtime.GOOS == "windows" {
+			assert.Equal(t, test.expected, result)
+		} else {
+			// On non-Windows platforms the shell already stripped shell-level quoting, so any quotes
+			// still present in the argument were typed deliberately and must be left untouched.
+			assert.Equal(t, test.input, result)
+		}
+	}
+}
+
+func TestGetCmdDoesNotQuotePropertyValues(t *testing.T) {
+	config := &gradleRunConfig{
+		gradle: "gradle",
+		tasks:  []string{"artifactoryPublish", "-Ddeploy.test.property='test test'"},
+		logger: utils.NewDefaultLogger(utils.INFO),
+	}
+
+	cmd := config.GetCmd()
+
+	expectedValue := "'test test'"
+	if runtime.GOOS == "windows" {
+		// Pre-existing quotes are only stripped on Windows, where the shell doesn't strip them itself.
+		expectedValue = "test test"
+	}
+	// exec.Command runs the process directly, without a shell, so quotes around the value would be passed to
+	// Gradle literally, instead of being stripped, if we didn't strip them ourselves.
+	assert.Equal(t, []string{"gradle", "artifactoryPublish", "-Ddeploy.test.property=" + expectedValue}, cmd.Args)
+}

entities/buildinfo.go

@@ -49,6 +49,7 @@ const (
 	Uv        ModuleType = "uv"
 	Gem       ModuleType = "gem"
 	Apk       ModuleType = "apk"
+	Cargo     ModuleType = "cargo"
 )
 
 type BuildInfo struct {

entities/buildinfo_test.go

@@ -569,3 +569,9 @@ func TestBuildInfoAppend_MavenSnapshotScenario(t *testing.T) {
 	assert.Len(t, buildInfo1.Modules[0].Artifacts, 1, "Should have 1 artifact")
 	assert.Equal(t, "deploy-sha", buildInfo1.Modules[0].Artifacts[0].Sha1, "Should have newer SHA1")
 }
+
+func TestCargoModuleType(t *testing.T) {
+	if Cargo != "cargo" {
+		t.Fatalf("expected Cargo module type to be %q, got %q", "cargo", Cargo)
+	}
+}