test: keep unknown batch wrappers out of the shell fallback

Author: NubsCarson

packages/core/src/runtime/engineProcess.spec.ts

@@ -51,6 +51,14 @@ describe("engine process launch", () => {
 });
 
 describe.skipIf(process.platform !== "win32")("Windows npm launcher", () => {
+  it("rejects unknown batch wrappers instead of forwarding arguments through a shell", () => {
+    for (const ext of ['cmd', 'bat']) {
+      const wrapper = join(binDir, `unknown.${ext}`);
+      writeFileSync(wrapper, '@echo off\r\necho %*\r\n');
+      expect(() => spawnEngine(wrapper, ['a"b&c'], { stdio: 'pipe' })).toThrow(/doesn't appear to be a cmd-shim/);
+    }
+  });
+
   it("runs a cmd shim in a spaced path with quoted and shell-special arguments", async () => {
     const args = ['two words', 'a"b', '(paren)', 'x&y', '%PATH%', 'semi;colon'];
     const child = spawnEngine(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });

packages/core/src/runtime/engineProcess.ts

@@ -10,7 +10,7 @@ export const spawnEngine = ((command, args, options) => {
   // Global npm shims require another cmd parsing pass, which can reinterpret
   // quoted arguments. Resolve their target as npm does for a symlink instead.
   // cross-spawn then follows the target's shebang without passing through cmd.
-  if (process.platform === "win32" && /\.cmd$/i.test(command)) {
+  if (process.platform === "win32" && /\.(?:cmd|bat)$/i.test(command)) {
     command = resolve(dirname(command), readCmdShim.sync(command));
   }
   return crossSpawn(command, args, options);