fix(electron-updater): escape quotes instead of throwing an error

[kevinlinv]

Descriptions

This dead150 commit was added as a security measure to avoid command injection when we use downloaded file path that contains quotes when running powershell command.

e.g: Get-AuthenticodeSignature 'C:\\path\\my-bad-';calc;'filename.exe' will start a calculator app.

Banning the quotes does stop the command injection, however it also introduce unwanted behavior when performing an update, an example, when the user's path contains a quote, update will never be installed. See: #4889

This PR

Fixes #4889 by escaping the quotation as per windows powershell documentation.

e.g.

// Unescaped
`Get-AuthenticodeSignature 'C:\\Users\\MyName's\\AppData\\Local\\MyApp.exe'`

// Escaped
`Get-AuthenticodeSignature 'C:\\Users\\MyName''s\\AppData\\Local\\MyApp.exe'`

Also when there is a command injection

// Unescaped
`Get-AuthenticodeSignature 'C:\\Users\\MyName';calc;'s\\AppData\\Local\\MyApp.exe'`

// Escaped
`Get-AuthenticodeSignature 'C:\\Users\\MyName'';calc;''s\\AppData\\Local\\MyApp.exe'`

The calculator app will not be opened.

[kevinlinv]

I am moving the check to the verifier, since I think that is the more appropriate location to do this!

[kevinlinv]

@develar could you help take a look at this PR please 🙏

We have a subset of user that can no longer automatically update their app because their username contains a ' character.

[kevinlinv]

Ping @develar

[kevinlinv]

Thanks for merging 👍

[sandeep1995]

Thank you very much.