Fix executeHooks to quote args for shell command (#8383)

.changeset/brave-cameras-call.md

@@ -0,0 +1,5 @@
+---
+"@graphql-codegen/cli": patch
+---
+
+Fix `executeHooks` to quote args for shell command

packages/graphql-codegen-cli/package.json

@@ -70,6 +70,7 @@
     "listr2": "^4.0.5",
     "log-symbols": "^4.0.0",
     "mkdirp": "^1.0.4",
+    "shell-quote": "^1.7.3",
     "string-env-interpolation": "^1.0.1",
     "ts-log": "^2.2.3",
     "tslib": "^2.4.0",
@@ -83,6 +84,7 @@
     "@types/is-glob": "4.0.2",
     "@types/js-yaml": "4.0.5",
     "@types/mkdirp": "1.0.2",
+    "@types/shell-quote": "^1.7.1",
     "bdd-stdin": "0.2.0",
     "change-case-all": "1.0.14",
     "js-yaml": "4.1.0",

packages/graphql-codegen-cli/src/hooks.ts

@@ -2,6 +2,7 @@ import { Types } from '@graphql-codegen/plugin-helpers';
 import { debugLog } from './utils/debugging.js';
 import { exec } from 'child_process';
 import { delimiter, sep } from 'path';
+import { quote } from 'shell-quote';
 
 const DEFAULT_HOOKS: Types.LifecycleHooksDefinition<string[]> = {
   afterStart: [],
@@ -76,10 +77,11 @@ async function executeHooks(
 ): Promise<void> {
   debugLog(`Running lifecycle hook "${hookName}" scripts...`);
 
+  const quotedArgs = quote(args);
   for (const script of scripts) {
     if (typeof script === 'string') {
-      debugLog(`Running lifecycle hook "${hookName}" script: ${script} with args: ${args.join(' ')}...`);
-      await execShellCommand(`${script} ${args.join(' ')}`);
+      debugLog(`Running lifecycle hook "${hookName}" script: ${script} with args: ${quotedArgs}...`);
+      await execShellCommand(`${script} ${quotedArgs}`);
     } else {
       debugLog(`Running lifecycle hook "${hookName}" script: ${script.name} with args: ${args.join(' ')}...`);
       await script(...args);
@@ -94,7 +96,7 @@ export const lifecycleHooks = (_hooks: Partial<Types.LifecycleHooksDefinition> =
     afterStart: async (): Promise<void> => executeHooks('afterStart', hooks.afterStart),
     onWatchTriggered: async (event: string, path: string): Promise<void> =>
       executeHooks('onWatchTriggered', hooks.onWatchTriggered, [event, path]),
-    onError: async (error: string): Promise<void> => executeHooks('onError', hooks.onError, [`"${error}"`]),
+    onError: async (error: string): Promise<void> => executeHooks('onError', hooks.onError, [error]),
     afterOneFileWrite: async (path: string): Promise<void> =>
       executeHooks('afterOneFileWrite', hooks.afterOneFileWrite, [path]),
     afterAllFileWrite: async (paths: string[]): Promise<void> =>

yarn.lock

@@ -3558,6 +3558,11 @@
     "@types/mime" "^1"
     "@types/node" "*"
 
+"@types/shell-quote@^1.7.1":
+  version "1.7.1"
+  resolved "https://registry.yarnpkg.com/@types/shell-quote/-/shell-quote-1.7.1.tgz#2d059091214a02c29f003f591032172b2aff77e8"
+  integrity sha512-SWZ2Nom1pkyXCDohRSrkSKvDh8QOG9RfAsrt5/NsPQC4UQJ55eG0qClA40I+Gkez4KTQ0uDUT8ELRXThf3J5jw==
+
 "@types/stack-utils@^2.0.0":
   version "2.0.1"
   resolved "https://registry.yarnpkg.com/@types/stack-utils/-/stack-utils-2.0.1.tgz#20f18294f797f2209b5f65c8e3b5c8e8261d127c"
@@ -11925,6 +11930,11 @@ shebang-regex@^3.0.0:
   resolved "https://registry.yarnpkg.com/shebang-regex/-/shebang-regex-3.0.0.tgz#ae16f1644d873ecad843b0307b143362d4c42172"
   integrity sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==
 
+shell-quote@^1.7.3:
+  version "1.7.3"
+  resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.7.3.tgz#aa40edac170445b9a431e17bb62c0b881b9c4123"
+  integrity sha512-Vpfqwm4EnqGdlsBFNmHhxhElJYrdfcxPThu+ryKS5J8L/fhAwLazFZtq+S+TWZ9ANj2piSQLGj6NQg+lKPmxrw==
+
 shiki@0.10.1:
   version "0.10.1"
   resolved "https://registry.yarnpkg.com/shiki/-/shiki-0.10.1.tgz#6f9a16205a823b56c072d0f1a0bcd0f2646bef14"