Bug Report

--- ✅ If you are in the correct location now... --->

• Yes, I reviewed the contribution guidelines.
• Yes, more specifically, I reviewed the guidelines on how to write clear bug reports.

Describe the current, buggy behavior

On macOS, at least, the wp cli update command fails when the path to the PHP binary running wp-cli (i.e. the value of PHP_BINARY when running the phar - see Utils\get_php_binary()) has a space in it. For our app, we give the option to download different versions of PHP, and we store those binaries in the Application Support folder. When a user is running wp-cli using any of those downloaded versions, the update will fail. However, it doesn't fail when they run the update command from our bundled version of PHP, which lives at a location without spaces in the path.

Describe how other contributors can replicate this bug

• Move the PHP binary to a location with a space in the path.
• Add it to $PATH and run an older version of wp-cli with it
• Run wp cli update and watch the command fail, saying the location doesn't exist, with the path given ending at the space.

Describe what you expect as the correct outcome

I expect the wp cli update command to succeed regardless of where the PHP binaries being used live.

Let us know what environment you are running this on

OS:	Darwin 22.5.0 Darwin Kernel Version 22.5.0: Thu Jun  8 22:22:22 PDT 2023; root:xnu-8796.121.3~7/RELEASE_X86_64 x86_64
Shell:	/bin/zsh
PHP binary:	/Users/adam.perry/Library/Application Support/Local/lightning-services/php-8.0.22+6/bin/darwin/bin/php
PHP version:	8.0.22
php.ini used:	/Users/adam.perry/Library/Application Support/Local/run/CiJoccyP_/conf/php/php.ini
MySQL binary:	/Users/adam.perry/dev/local/flywheel-local/extraResources/lightning-services/mysql-8.0.16+6/bin/darwin/bin/mysql
MySQL version:	mysql  Ver 8.0.16 for macos10.14 on x86_64 (MySQL Community Server - GPL)
SQL modes:	
WP-CLI root dir:	phar://wp-cli.phar/vendor/wp-cli/wp-cli
WP-CLI vendor dir:	phar://wp-cli.phar/vendor
WP_CLI phar path:	/Users/adam.perry/Local Sites/vernacom/app/public
WP-CLI packages dir:	
WP-CLI cache dir:	/Users/adam.perry/.wp-cli/cache
WP-CLI global config:	/Users/adam.perry/dev/local/flywheel-local/extraResources/bin/wp-cli/config.yaml
WP-CLI project config:	
WP-CLI version:	2.7.1

Provide a possible solution

In CLI_Command.php > CLI_Command > update, change:

$php_binary = Utils\get_php_binary();

to

$php_binary = escapeshellarg(Utils\get_php_binary());

DIFF:

diff --git a/php/commands/src/CLI_Command.php b/php/commands/src/CLI_Command.php
index 9ed7e080..09b3e1ec 100644
--- a/php/commands/src/CLI_Command.php
+++ b/php/commands/src/CLI_Command.php
@@ -356,7 +356,7 @@ class CLI_Command extends WP_CLI_Command {
                }
 
                $allow_root = WP_CLI::get_runner()->config['allow-root'] ? '--allow-root' : '';
-               $php_binary = Utils\get_php_binary();
+               $php_binary =escapeshellarg( Utils\get_php_binary());
                $process    = Process::create( "{$php_binary} $temp --info {$allow_root}" );
                $result     = $process->run();
                if ( 0 !== $result->return_code || false === stripos( $result->stdout, 'WP-CLI version' ) ) {

Provide additional context/screenshots