Fixes moxystudio#51: can spawn commands containing %<environment variable name>%

Passes command string to cmd.exe as an environment variable
cmd.exe unsets the environment variable and then runs the command
cross-spawn avoids environment variable naming conflicts

Author: cspotcode

lib/parse.js

@@ -14,6 +14,10 @@ function parseNonShell(parsed) {
     var shebang;
     var needsShell;
     var applyQuotes;
+    var command;
+    var args;
+    var envVariableName;
+    var envVariableSuffix = 1;
 
     if (!isWin) {
         return parsed;
@@ -36,13 +40,20 @@ function parseNonShell(parsed) {
     if (needsShell) {
         // Escape command & arguments
         applyQuotes = (parsed.command !== 'echo');  // Do not quote arguments for the special "echo" command
-        parsed.command = escapeCommand(parsed.command);
-        parsed.args = parsed.args.map(function (arg) {
+        command = escapeCommand(parsed.command);
+        args = parsed.args.map(function (arg) {
             return escapeArgument(arg, applyQuotes);
         });
 
         // Make use of cmd.exe
-        parsed.args = ['/d', '/s', '/c', '"' + parsed.command + (parsed.args.length ? ' ' + parsed.args.join(' ') : '') + '"'];
+        // Pass command as environment variable
+        parsed.options.env = assign({}, parsed.options.env || process.env);
+        do {
+            envVariableName = 'cross_spawn_command_' + envVariableSuffix;
+            envVariableSuffix += 1;
+        } while (Object.prototype.hasOwnProperty.call(parsed.options.env, envVariableName));
+        parsed.options.env[envVariableName] = command + (args.length ? ' ' + args.join(' ') : '');
+        parsed.args = ['/d', '/s', '/c', '"set ' + envVariableName + '=& %' + envVariableName + '%"'];
         parsed.command = process.env.comspec || 'cmd.exe';
         parsed.options.windowsVerbatimArguments = true;  // Tell node's spawn that the arguments are already escaped
     }
@@ -107,4 +118,16 @@ function parse(command, args, options) {
     return options.shell ? parseShell(parsed) : parseNonShell(parsed);
 }
 
+// Like Object.assign, for older node versions
+function assign(target, source) {
+    var key;
+
+    for (key in source) {
+        if (Object.prototype.hasOwnProperty.call(source, key)) {
+            target[key] = source[key];
+        }
+    }
+    return target;
+}
+
 module.exports = parse;