Symfony version(s) affected

5.4+

Description

On windows, some commands like rmdir are built-in commands inside cmd.exe, and not a rmdir.exe process.. And it seems cmd.exe has trouble parsing flags when they are escaped via the env var thing of#21474 (cc@nicolas-grekas).

How to reproduce

<?phpinclude'vendor/autoload.php';mkdir('test/foo/bar',0777,true);$p =newSymfony\Component\Process\Process(['rmdir','/S','/Q','test']);$p->run();var_dump($p->getOutput(),$p->getErrorOutput(),$p->getExitCode());$p =Symfony\Component\Process\Process::fromShellCommandline('rmdir /S /Q test');$p->run();var_dump($p->getOutput(),$p->getErrorOutput(),$p->getExitCode());$p =newSymfony\Component\Process\Process(['ipconfig']);$p->run();var_dump($p->getOutput());$p =newSymfony\Component\Process\Process(['ipconfig','/all']);$p->run();var_dump($p->getOutput());// correctly shows more info than without /all flag, so this works

Running the above outputs this for the first command using symfony escaping:

string(0) ""string(117) "The system cannot find the file specified.The system cannot find the file specified.The directory is not empty."int(145)

You can see there are 3 errors, because it takes /S, /Q and test as 3 arguments and not two option flags and one argument. So it doesn't find "/S" which indeed is no valid path, same for "/Q", then it finds test but cannot delete it as it is not empty and it requires /S for that to work, but it didn't detect it as an option.

string(0) ""string(0) ""int(0)

This second version using a string command works fine.

The ipconfig test works fine in both ways, so I am unsure if the problem is dependent on which command runs, or if it's just cmd.exe built-ins, or what the root cause is.

Possible Solution

I'd say maybe we don't need to escape strings that are just/[a-zA-Z0-9]+, as that seems safe.

Additional Context

Found viacomposer/composer#12180