Fix: Properly escape PHP binary path in wp cli update

[Copilot]

wp cli update fails when the PHP binary path contains spaces because string interpolation doesn't escape shell arguments. The shell interprets /Users/user/Library/Application Support/php as separate tokens, causing "No such file or directory" errors.

Changes

• CLI_Command.php (line 381): Replace string interpolation with Utils\esc_cmd() to properly escape all command arguments

  # Before
  $process = Process::create( "{$php_binary} $temp --info {$allow_root}" );
  
  # After  
  $process = Process::create( Utils\esc_cmd( '%s %s --info %s', $php_binary, $temp, $allow_root ) );

• features/cli.feature: Add regression test that copies PHP binary to a directory with spaces and validates update succeeds using WP_CLI_PHP_USED environment variable

Notes

The vendor file change is force-committed for demonstration. In production, this fix should be applied to the upstream wp-cli/wp-cli repository first, then pulled into the bundle via composer update. The test in this bundle will validate end-to-end integration.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Update command doesn't escape php_binary path, update fails when path has spaces</issue_title>
<issue_description>## Bug Report

--- ✅ If you are in the correct location now... --->

• Yes, I reviewed the contribution guidelines.
• Yes, more specifically, I reviewed the guidelines on how to write clear bug reports.

Describe the current, buggy behavior

On macOS, at least, the wp cli update command fails when the path to the PHP binary running wp-cli (i.e. the value of PHP_BINARY when running the phar - see Utils\get_php_binary()) has a space in it. For our app, we give the option to download different versions of PHP, and we store those binaries in the Application Support folder. When a user is running wp-cli using any of those downloaded versions, the update will fail. However, it doesn't fail when they run the update command from our bundled version of PHP, which lives at a location without spaces in the path.

Describe how other contributors can replicate this bug

• Move the PHP binary to a location with a space in the path.
• Add it to $PATH and run an older version of wp-cli with it
• Run wp cli update and watch the command fail, saying the location doesn't exist, with the path given ending at the space.

Describe what you expect as the correct outcome

I expect the wp cli update command to succeed regardless of where the PHP binaries being used live.

Let us know what environment you are running this on

OS:	Darwin 22.5.0 Darwin Kernel Version 22.5.0: Thu Jun  8 22:22:22 PDT 2023; root:xnu-8796.121.3~7/RELEASE_X86_64 x86_64
Shell:	/bin/zsh
PHP binary:	/Users/adam.perry/Library/Application Support/Local/lightning-services/php-8.0.22+6/bin/darwin/bin/php
PHP version:	8.0.22
php.ini used:	/Users/adam.perry/Library/Application Support/Local/run/CiJoccyP_/conf/php/php.ini
MySQL binary:	/Users/adam.perry/dev/local/flywheel-local/extraResources/lightning-services/mysql-8.0.16+6/bin/darwin/bin/mysql
MySQL version:	mysql  Ver 8.0.16 for macos10.14 on x86_64 (MySQL Community Server - GPL)
SQL modes:	
WP-CLI root dir:	phar://wp-cli.phar/vendor/wp-cli/wp-cli
WP-CLI vendor dir:	phar://wp-cli.phar/vendor
WP_CLI phar path:	/Users/adam.perry/Local Sites/vernacom/app/public
WP-CLI packages dir:	
WP-CLI cache dir:	/Users/adam.perry/.wp-cli/cache
WP-CLI global config:	/Users/adam.perry/dev/local/flywheel-local/extraResources/bin/wp-cli/config.yaml
WP-CLI project config:	
WP-CLI version:	2.7.1

Provide a possible solution

In CLI_Command.php > CLI_Command > update, change:

$php_binary = Utils\get_php_binary();

to

$php_binary = escapeshellarg(Utils\get_php_binary());

DIFF:

diff --git a/php/commands/src/CLI_Command.php b/php/commands/src/CLI_Command.php
index 9ed7e080..09b3e1ec 100644
--- a/php/commands/src/CLI_Command.php
+++ b/php/commands/src/CLI_Command.php
@@ -356,7 +356,7 @@ class CLI_Command extends WP_CLI_Command {
                }
 
                $allow_root = WP_CLI::get_runner()->config['allow-root'] ? '--allow-root' : '';
-               $php_binary = Utils\get_php_binary();
+               $php_binary =escapeshellarg( Utils\get_php_binary());
                $process    = Process::create( "{$php_binary} $temp --info {$allow_root}" );
                $result     = $process->run();
                if ( 0 !== $result->return_code || false === stripos( $result->stdout, 'WP-CLI version' ) ) {

Provide additional context/screenshots

</issue_description>

<agent_instructions>Follow these reproduction steps to create a new Behat test replicating this bug</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@danielbachhuber Thanks for the report, @adamperrry !

It'd probably be better to switch the entire thing to WP_CLI\Utils\esc_cmd():

https://github.com/wp-cli/wp-cli/blob/90be24dcbb4c89b2f4b1f9e9562b474fb3b50716/php/utils.php#L269-L283

Feel free to submit a pull request, if you'd like. Here is some guidance on our pull request best practices.

We have some existing tests in the bundle, so I don't think you need to add new tests for this scenario:

wp-cli-bundle/features/cli.feature

Lines 31 to 71 in 22e60f0

	Scenario: Do WP-CLI Update
	Given an empty directory
	And a new Phar with version "0.0.0"
	When I run `{PHAR_PATH} --info`
	Then STDOUT should contain:
	"""
	WP-CLI version
	"""
	And STDOUT should contain:
	"""
	0.0.0
	"""
	When I run `{PHAR_PATH} cli update --yes`
	Then STDOUT should contain:
	"""
	md5 hash verified:
	"""
	And STDOUT should contain:
	"""
	Success:
	"""
	And STDERR should be empty
	And the return code should be 0
	When I run `{PHAR_PATH} --info`
	Then STDOUT should contain:
	"""
	WP-CLI version
	"""
	And STDOUT should not contain:
	"""
	0.0.0
	"""
	When I run `{PHAR_PATH} cli update`
	Then STDOUT should be:
	"""
	Success: WP-CLI is at the latest version.
	"""

</comment_new>
<comment_new>@danielbachhuber
@adamperrry Looks like there's some problem with esc_cmd(), unfortunately: https://github.com/wp-c...

• Fixes Update command doesn't escape php_binary path, update fails when path has spaces wp-cli#5815

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!