René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Windows: DEP0190 警告 — spawn shell:true + args 数组","articleBody":"## 问题\n\n启动 deepcode 时出现 Node.js 废弃警告：\n\n```\n(node:123548) [DEP0190] DeprecationWarning: Passing args to a child process\nwith shell option true can lead to security vulnerabilities, as the\narguments are not escaped, only concatenated.\n```\n\n## 根因\n\nPR #77 修复 Windows CI 时，将 McpClient 的 spawn 调用从：\n\n```js\nconst cmd = [this.command + \".cmd\", ...args].join(\" \");\nspawn(cmd, [], { shell: true });\n```\n\n改为：\n\n```js\nspawn(this.command, args, { shell: true });\n```\n\n目的是去掉强制拼接 `.cmd` 后缀，让 cmd.exe 通过 PATHEXT 环境变量自动解析 `npx` → `npx.cmd`。但 Node.js 在 `shell: true` 模式下直接传 args 数组会触发 DEP0190 警告——Node 只做简单拼接不转义，存在注入风险。\n\n## 修复方案\n\n将 args 手动拼成字符串后传入，避免触发 DEP0190：\n\n```diff\n- this.process = spawn(this.command, args, {\n+ this.process = spawn([this.command, ...args].join(\" \"), [], {\n    stdio: [\"pipe\", \"pipe\", \"pipe\"],\n    env: childEnv,\n    shell: true,\n    windowsHide: true,\n  });\n```\n\n逻辑等价——cmd.exe 仍通过 PATHEXT 解析命令，不会触发 DEP0190，也不会有之前的 `.cmd` 后缀 bug。","author":{"url":"https://github.com/dengmik-commits","@type":"Person","name":"dengmik-commits"},"datePublished":"2026-05-16T10:38:46.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/85/deepcode-cli/issues/85"}