From 44f6c0ed1ed3381d44d44fac9070279bdf387902 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kai=20K=C3=B6hne?= Date: Fri, 3 Dec 2021 08:45:56 +0100 Subject: [PATCH] androiddeployqt: Fix signing of paths with spaces Only use shellQuote() if the path is actually passed to a native API. For QFile API, use the unquoted path. Fixes: QTBUG-97649 Change-Id: I9d8131819010bbd2faa8a81eef367245d90a767f Reviewed-by: Assam Boudjelthia (cherry picked from commit 6598a26a138aaab13e28905a28e7ce21011d30b5) Reviewed-by: Qt Cherry-pick Bot --- src/tools/androiddeployqt/main.cpp | 45 ++++++++++++++++-------------- 1 file changed, 24 insertions(+), 21 deletions(-) diff --git a/src/tools/androiddeployqt/main.cpp b/src/tools/androiddeployqt/main.cpp index 9eb4a90c2e8..b417bfa4d1e 100644 --- a/src/tools/androiddeployqt/main.cpp +++ b/src/tools/androiddeployqt/main.cpp @@ -2678,7 +2678,7 @@ QString packagePath(const Options &options, PackageType pt) path += QLatin1String(".aab"); } } - return shellQuote(path); + return path; } bool installApk(const Options &options) @@ -2805,9 +2805,10 @@ bool jarSignerSignPackage(const Options &options) auto signPackage = [&](const QString &file) { fprintf(stdout, "Signing file %s\n", qPrintable(file)); fflush(stdout); - QString command = jarSignerTool + QLatin1String(" %1 %2") - .arg(file) - .arg(shellQuote(options.keyStoreAlias)); + QString command = jarSignerTool + + QLatin1String(" %1 %2") + .arg(shellQuote(file)) + .arg(shellQuote(options.keyStoreAlias)); FILE *jarSignerCommand = openProcess(command); if (jarSignerCommand == 0) { @@ -2853,10 +2854,10 @@ bool jarSignerSignPackage(const Options &options) } zipAlignTool = QLatin1String("%1%2 -f 4 %3 %4") - .arg(shellQuote(zipAlignTool), - options.verbose ? QLatin1String(" -v") : QLatin1String(), - packagePath(options, UnsignedAPK), - packagePath(options, SignedAPK)); + .arg(shellQuote(zipAlignTool), + options.verbose ? QLatin1String(" -v") : QLatin1String(), + shellQuote(packagePath(options, UnsignedAPK)), + shellQuote(packagePath(options, SignedAPK))); FILE *zipAlignCommand = openProcess(zipAlignTool); if (zipAlignCommand == 0) { @@ -2921,10 +2922,11 @@ bool signPackage(const Options &options) return pclose(zipAlignCommand) == 0; }; - const QString verifyZipAlignCommandLine = QLatin1String("%1%2 -c 4 %3") - .arg(shellQuote(zipAlignTool), - options.verbose ? QLatin1String(" -v") : QLatin1String(), - packagePath(options, UnsignedAPK)); + const QString verifyZipAlignCommandLine = + QLatin1String("%1%2 -c 4 %3") + .arg(shellQuote(zipAlignTool), + options.verbose ? QLatin1String(" -v") : QLatin1String(), + shellQuote(packagePath(options, UnsignedAPK))); if (zipalignRunner(verifyZipAlignCommandLine)) { if (options.verbose) @@ -2941,11 +2943,12 @@ bool signPackage(const Options &options) if (options.verbose) fprintf(stdout, "APK not aligned, aligning it for signing.\n"); - const QString zipAlignCommandLine = QLatin1String("%1%2 -f 4 %3 %4") - .arg(shellQuote(zipAlignTool), - options.verbose ? QLatin1String(" -v") : QLatin1String(), - packagePath(options, UnsignedAPK), - packagePath(options, SignedAPK)); + const QString zipAlignCommandLine = + QLatin1String("%1%2 -f 4 %3 %4") + .arg(shellQuote(zipAlignTool), + options.verbose ? QLatin1String(" -v") : QLatin1String(), + shellQuote(packagePath(options, UnsignedAPK)), + shellQuote(packagePath(options, SignedAPK))); if (!zipalignRunner(zipAlignCommandLine)) { fprintf(stderr, "zipalign command failed.\n"); @@ -2970,8 +2973,7 @@ bool signPackage(const Options &options) if (options.verbose) apkSignCommand += QLatin1String(" --verbose"); - apkSignCommand += QLatin1String(" %1") - .arg(packagePath(options, SignedAPK)); + apkSignCommand += QLatin1String(" %1").arg(shellQuote(packagePath(options, SignedAPK))); auto apkSignerRunner = [](const QString &command, bool verbose) { FILE *apkSigner = openProcess(command); @@ -2998,8 +3000,9 @@ bool signPackage(const Options &options) if (!apkSignerRunner(apkSignCommand, options.verbose)) return false; - const QString apkVerifyCommand = QLatin1String("%1 verify --verbose %2") - .arg(shellQuote(apksignerTool), packagePath(options, SignedAPK)); + const QString apkVerifyCommand = + QLatin1String("%1 verify --verbose %2") + .arg(shellQuote(apksignerTool), shellQuote(packagePath(options, SignedAPK))); // Verify the package and remove the unsigned apk return apkSignerRunner(apkVerifyCommand, true) && QFile::remove(packagePath(options, UnsignedAPK));