[🐛 Bug]: Build fails in Node v20.16.0 (Unexpected error: spawn Unknown system error -8)

[danielcardeenas]

next-on-pages environment related information

⚡️ @cloudflare/next-on-pages CLI v.1.13.2
⚡️ Unexpected error: spawn Unknown system error -8
 wedding-planner-webapp  npm run pages:build

npx @cloudflare/next-on-pages

⚡️ @cloudflare/next-on-pages CLI v.1.13.2
⚡️ Unexpected error: spawn Unknown system error -8

Description

Package is using shellac which fails due to a security issue in late Node versions (v20.16.0 in my case).
Happens in Mac and possibly also in Windows

Complete error log:

Error: spawn Unknown system error -8
    at ChildProcess.spawn (node:internal/child_process:421:11)
    at Object.spawn (node:child_process:761:9)
    at new Shell (/Users/danielcardenas/projects/wedding-planner-webapp/node_modules/@cloudflare/next-on-pages/dist/index.js:5062:49)
    at lazyCreateShell (/Users/danielcardenas/projects/wedding-planner-webapp/node_modules/@cloudflare/next-on-pages/dist/index.js:5966:39)
    at /Users/danielcardenas/projects/wedding-planner-webapp/node_modules/@cloudflare/next-on-pages/dist/index.js:5980:23
    at f2 (/Users/danielcardenas/projects/wedding-planner-webapp/node_modules/@cloudflare/next-on-pages/dist/index.js:6334:34)
    at W (/Users/danielcardenas/projects/wedding-planner-webapp/node_modules/@cloudflare/next-on-pages/dist/index.js:6340:31)
    at async buildApplication (/Users/danielcardenas/projects/wedding-planner-webapp/node_modules/@cloudflare/next-on-pages/dist/index.js:13521:14)
    at async /Users/danielcardenas/projects/wedding-planner-webapp/node_modules/@cloudflare/next-on-pages/dist/index.js:13677:7 {
  errno: -8,
  code: 'Unknown system error -8',
  syscall: 'spawn'
}

Source: https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2#command-injection-via-args-parameter-of-child_processspawn-without-shell-option-enabled-on-windows-cve-2024-27980---high

Reproduction

Install Node v20.16
Run:

npx @cloudflare/next-on-pages

Pages Deployment Method

Direct Upload (wrangler pages publish or the @cloudflare/pages-action GitHub Action)

Pages Deployment ID

No response

Additional Information

Proposed fix:

https://github.com/geelen/shellac/pull/17/files

Or patch:

# node_modules/@cloudflare/next-on-pages/dist/index.js @ ~5065
var Shell = class {
  process;
  constructor(overrides) {
    const env2 = {
      ...{ PS1: "", PATH: process.env.PATH },
      ...overrides
    };
    this.process = import_child_process.default.spawn("bash", ["--noprofile", "--norc"], {
      env: env2,
      detached: true,
+     shell: true
    });
    this.process.stdout.setEncoding("utf8");
    ...

Would you like to help?

• Would you like to help fixing this bug?