fix: quote sync tool binary before local shell execution

Author: konradmichalik

deployer/dev/task/dump.php

@@ -26,6 +26,6 @@
     $dumpLocationOptions = usingPhpSyncTool($dbSyncTool) ? '' : "-kd $dbDumpDir -dn $dbDumpFilename";
 
     $dbSyncToolConfigPath = get('dev_db_sync_tool_config_path');
-    runLocally("$dbSyncTool -f $dbSyncToolConfigPath/$dbSyncToolSync -y $dumpLocationOptions $additionalOptions", ['real_time_output' => true]);
+    runLocally(escapeshellarg($dbSyncTool) . " -f $dbSyncToolConfigPath/$dbSyncToolSync -y $dumpLocationOptions $additionalOptions", ['real_time_output' => true]);
 })
     ->desc('Sync database with drush');

deployer/dev/task/import.php

@@ -11,6 +11,6 @@
     $dbSyncTool = requireSyncTool('import');
 
     $dbSyncToolConfigPath = get('dev_db_sync_tool_config_path');
-    runLocally("$dbSyncTool -f $dbSyncToolConfigPath/$dbSyncToolSync -y -i $dbDumpDir/$dbDumpFilename.sql", ['real_time_output' => true]);
+    runLocally(escapeshellarg($dbSyncTool) . " -f $dbSyncToolConfigPath/$dbSyncToolSync -y -i $dbDumpDir/$dbDumpFilename.sql", ['real_time_output' => true]);
 })
     ->desc('Sync database with drush');

deployer/dev/task/sync.php

@@ -50,7 +50,7 @@
     $dbSyncTool = requireSyncTool('sync');
 
     $dbSyncToolConfigPath = get('dev_db_sync_tool_config_path');
-    runLocally("$dbSyncTool -f $dbSyncToolConfigPath/$dbSyncToolSync -y $additionalOptions", ['real_time_output' => true]);
+    runLocally(escapeshellarg($dbSyncTool) . " -f $dbSyncToolConfigPath/$dbSyncToolSync -y $additionalOptions", ['real_time_output' => true]);
     info("💽 Database from $target synced successfully");
 })
     ->desc('Sync database with db-sync-tool');

deployer/feature/task/feature_sync.php

@@ -133,7 +133,7 @@ function resolveDatabaseHostToIp(string $hostname): void
             // php-sync-tool has file sync integrated, no separate file_sync_tool call needed
             $withFiles = $isPhpSyncTool && false !== get('file_sync_tool') ? '--with-files' : '';
             info('Synching database');
-            runLocally("$dbSyncTool -f {{feature_sync_config}} --target-path {{feature_sync_target_path}} $useRsync $withFiles -y $optionalVerbose");
+            runLocally(escapeshellarg($dbSyncTool) . " -f {{feature_sync_config}} --target-path {{feature_sync_target_path}} $useRsync $withFiles -y $optionalVerbose");
             $synced = true;
         } else {
             debug("Skipping database sync, command \”$dbSyncTool\” not available");

deployer/functions.php

@@ -138,7 +138,7 @@ function commandExistLocally(string $command): bool
  */
 function isExecutableLocally(string $path): bool
 {
-    return testLocally("[ -x $path ]");
+    return testLocally('[ -x ' . escapeshellarg($path) . ' ]');
 }
 
 /**

deployer/sync/task/database_backup.php

@@ -16,7 +16,7 @@
     if (syncToolAvailableLocally($dbSyncTool)) {
         $useRsync = usingPhpSyncTool($dbSyncTool) ? '' : '--use-rsync';
         info('Generating a database backup');
-        runLocally("$dbSyncTool -f {{sync_database_backup_config}} $useRsync -y $optionalVerbose");
+        runLocally(escapeshellarg($dbSyncTool) . " -f {{sync_database_backup_config}} $useRsync -y $optionalVerbose");
     } else {
         debug("Skipping database backup, $dbSyncTool not available");
     }