lifecycle: add /d and /s to cmd.exe

/d disables cmd.exe AutoRuns feature, where registry entry points to the
script that will be executed when cmd.exe starts. Surprisingly a lot of
users hase "CD \" or similar command there which causes lifecycle
scripts to fail, since relative path to the script no longer works (and
package.json has no way to deduce absolute path)

/s enables handling of quotes, so that you can have "C:\Program
Files\Node\node.exe" quoted in your script. Node's child_process.exec()
is doing the same. We prevent additional quoting by libuv already by
setting uv_spawn() flag UV_PROCESS_WINDOWS_VERBATIM_ARGUMENTS.

If those flags are not set there is no way package.json can reliably
tell us to run "node" executable with a relative script path:

    "scripts": {
      "install": "node scripts/install.js"
    }

Without /d "node" invocation may end up in a random directory as a
result of the AutoRuns command.

Fixes: #8751
Fixes: #7333

PR-URL: https://github.com/npm/npm/pull/9245

1 files changed, 1 insertions, 1 deletions

diff --git a/lib/utils/lifecycle.js b/lib/utils/lifecycle.js
index aa14405f8..d4c5e062f 100644
--- a/lib/utils/lifecycle.js
+++ b/lib/utils/lifecycle.js
@@ -207,7 +207,7 @@ function runCmd_ (cmd, pkg, env, wd, stage, unsafe, uid, gid, cb_) {
 
   if (process.platform === 'win32') {
     sh = process.env.comspec || 'cmd'
-    shFlag = '/c'
+    shFlag = '/d /s /c'
     conf.windowsVerbatimArguments = true
   }