fix(deploy): launch package managers cross-platform via cross-spawn

execFileSync cannot launch the .cmd/.bat shims that npm, yarn, pnpm and
cnpm ship as on Windows, so the previous conversion broke `ng deploy`
there on the default SSR-to-Cloud-Functions path. Route the npm install
and the `<pm> list` calls through cross-spawn instead: it escapes each
argument and, on Windows, invokes the shim through cmd.exe, keeping the
injection closed without falling back to `shell: true` (whose args-array
form Node runtime-deprecates under DEP0190).

Funnel both calls through a single exported processHost.runPackageBin so
tests can assert the deploy code shells out only through the shell-free
runner. Add specs that fail if a call site regresses to a shell or drops
a validator. Drop the outputPath schema pattern, which rejected legit
path characters while never guarding the whitespace that the Cloud Run
path actually splits on; that argument-injection surface is tracked
separately in #3726.

Author: herdiyana256

package-lock.json

@@ -60,6 +60,7 @@
     "@angular/platform-browser-dynamic": "^21.0.0",
     "@angular/router": "^21.0.0",
     "@schematics/angular": "^21.0.0",
+    "cross-spawn": "^7.0.3",
     "esbuild": "^0.24.0",
     "firebase": "^12.4.0",
     "firebase-functions": "^6.1.0",
@@ -86,6 +87,7 @@
     "@angular/cli": "^21.0.0",
     "@angular/compiler-cli": "^21.0.0",
     "@angular/platform-server": "^21.0.0",
+    "@types/cross-spawn": "^6.0.6",
     "@types/fs-extra": "^7.0.0",
     "@types/gzip-size": "^5.1.1",
     "@types/inquirer": "^0.0.44",
@@ -99,7 +101,6 @@
     "@typescript-eslint/eslint-plugin": "^8.33.0",
     "@typescript-eslint/parser": "^8.33.0",
     "conventional-changelog-cli": "^1.2.0",
-    "cross-spawn": "^7.0.3",
     "eslint": "^9.27.0",
     "eslint-plugin-import": "^2.31.0",
     "globals": "^13.21.0",

package.json

@@ -3,7 +3,7 @@ import { join } from 'path';
 import { BuilderContext, BuilderRun, ScheduleOptions, Target } from '@angular-devkit/architect';
 import { JsonObject, logging } from '@angular-devkit/core';
 import { BuildTarget, FSHost, FirebaseDeployConfig, FirebaseTools } from '../interfaces';
-import deploy, { assertSafeDependencyName, assertSupportedPackageManager, deployToFunction } from './actions.js'
+import deploy, { assertSafeDependencyName, assertSupportedPackageManager, deployToFunction, findPackageVersion, processHost } from './actions.js'
 import 'jasmine';
 
 let context: BuilderContext;
@@ -332,4 +332,59 @@ describe('deploy input validation (command-injection hardening)', () => {
       });
     });
   });
+
+  // These guard the fix at its call sites: the validators above are only useful
+  // if the deploy code keeps routing every command through the shell-free runner.
+  // A regression to execSync/`shell: true`, or a dropped validator call, fails here.
+  describe('call sites route through the shell-free runner', () => {
+    beforeEach(() => initMocks());
+
+    it('installs functions dependencies via the runner with an argv array and no shell', async () => {
+      // The install branch only runs when the generated package.json exists.
+      spyOn(fsHost, 'existsSync').and.returnValue(true);
+      const runSpy = spyOn(processHost, 'runPackageBin').and.returnValue(Buffer.from(''));
+
+      await deployToFunction(
+        firebaseMock,
+        context,
+        workspaceRoot,
+        STATIC_BUILD_TARGET,
+        SERVER_BUILD_TARGET,
+        { preview: false },
+        undefined,
+        fsHost
+      );
+
+      expect(runSpy).toHaveBeenCalledTimes(1);
+      const [command, args, options] = runSpy.calls.mostRecent().args;
+      expect(command).toBe('npm');
+      expect(args).toEqual(['--prefix', join(workspaceRoot, 'dist'), 'install']);
+      // No shell: a `shell` option would reopen the injection this PR closes.
+      expect((options as any)?.shell).toBeFalsy();
+    });
+
+    it('runs the package manager through the runner with a validated argv array', () => {
+      const runSpy = spyOn(processHost, 'runPackageBin').and.returnValue(Buffer.from(''));
+
+      findPackageVersion('npm', 'rxjs');
+
+      expect(runSpy).toHaveBeenCalledWith('npm', ['list', 'rxjs']);
+    });
+
+    it('rejects an unsupported package manager before spawning anything', () => {
+      const runSpy = spyOn(processHost, 'runPackageBin');
+
+      expect(() => findPackageVersion('npm; touch /tmp/pwned #', 'rxjs'))
+        .toThrowError(/Unsupported package manager/);
+      expect(runSpy).not.toHaveBeenCalled();
+    });
+
+    it('rejects an unsafe dependency name before spawning anything', () => {
+      const runSpy = spyOn(processHost, 'runPackageBin');
+
+      expect(() => findPackageVersion('npm', 'evil; touch /tmp/pwned #'))
+        .toThrowError(/Invalid dependency name/);
+      expect(runSpy).not.toHaveBeenCalled();
+    });
+  });
 });

src/schematics/deploy/actions.jasmine.ts

@@ -1,9 +1,10 @@
-import { SpawnOptionsWithoutStdio, execFileSync, spawn } from 'child_process';
+import { SpawnOptionsWithoutStdio, SpawnSyncOptions, spawn } from 'child_process';
 import { existsSync, readFileSync, renameSync, writeFileSync } from 'fs';
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
 import { BuilderContext, targetFromTargetString } from '@angular-devkit/architect';
 import { SchematicsException } from '@angular-devkit/schematics';
+import crossSpawn from 'cross-spawn';
 import fsExtra from 'fs-extra';
 import * as inquirer from 'inquirer';
 import open from 'open';
@@ -156,11 +157,39 @@ export const assertSafeDependencyName = (name: string): string => {
   return name;
 };
 
-const findPackageVersion = (packageManager: string, name: string) => {
-  // Run the package manager without a shell (execFileSync + argument array) so a
-  // dependency name or package-manager value taken from angular.json cannot be
-  // interpreted as a shell command.
-  const output = execFileSync(assertSupportedPackageManager(packageManager), [
+// All shelling out from the deploy builder funnels through this single runner.
+// cross-spawn (v7) resolves the platform-appropriate executable and escapes each
+// argument, so a value taken from angular.json is passed as an argv entry and can
+// never be parsed as shell syntax. Unlike child_process.execFile it can launch a
+// Windows `.cmd`/`.bat` shim (npm, yarn, pnpm and cnpm all ship as `.cmd` shims
+// there), so `ng deploy` keeps working cross-platform. We deliberately avoid
+// `shell: true`, whose args-array form Node runtime-deprecates (DEP0190) because
+// it concatenates the arguments without escaping, reopening the injection.
+// It is exported as an object so tests can assert the deploy code shells out only
+// through here and never regresses to execSync or `shell: true`.
+export const processHost = {
+  runPackageBin(
+    command: string,
+    args: string[],
+    options: SpawnSyncOptions = {},
+  ): Buffer {
+    const result = crossSpawn.sync(command, args, options);
+    if (result.error) { throw result.error; }
+    if (result.status !== 0) {
+      throw new SchematicsException(
+        `Command "${command}" exited with ${result.signal ? `signal ${result.signal}` : `code ${result.status}`}.`
+      );
+    }
+    return result.stdout;
+  },
+};
+
+export const findPackageVersion = (packageManager: string, name: string) => {
+  // Run the package manager without a shell (argument array, no `shell` option)
+  // so a dependency name or package-manager value taken from angular.json cannot
+  // be interpreted as a shell command. Both values are validated first, so an
+  // unsupported manager or unsafe name throws before anything is ever spawned.
+  const output = processHost.runPackageBin(assertSupportedPackageManager(packageManager), [
     'list',
     assertSafeDependencyName(name),
   ]).toString();
@@ -287,10 +316,12 @@ export const deployToFunction = async (
   const siteTarget = options.target ?? context.target!.project;
 
   if (fsHost.existsSync(functionsPackageJsonPath)) {
-    // Pass the output directory as an argument rather than interpolating it into
-    // a shell string; `functionsOut` derives from the `outputPath` deploy option
-    // (angular.json) and must not be able to inject shell commands.
-    execFileSync('npm', ['--prefix', functionsOut, 'install']);
+    // Pass the output directory as an argv entry rather than interpolating it
+    // into a shell string; `functionsOut` derives from the `outputPath` deploy
+    // option (angular.json) and must not be able to inject shell commands. npm is
+    // a `.cmd` shim on Windows, which child_process.execFile cannot launch, so
+    // this goes through the shell-free cross-spawn runner instead.
+    processHost.runPackageBin('npm', ['--prefix', functionsOut, 'install'], { stdio: 'inherit' });
   } else {
     console.error(`No package.json exists at ${functionsOut}`);
   }

src/schematics/deploy/actions.ts

@@ -67,8 +67,7 @@
     },
     "outputPath": {
       "type": "string",
-      "description": "Where to output the deploy artifacts",
-      "pattern": "^[^;&|$`<>\\n\\r()]*$"
+      "description": "Where to output the deploy artifacts"
     },
     "functionsRuntimeOptions": {
       "type": "object",