@nx/web:file-server with buildTarget fails on Windows

[DanielRose]

Current Behavior

I have a (seldomly used) build target with the executor @nx/web:file-server, using a buildTarget in its options. Now I noticed that the target fails, with an unhelpful error:

Error: Build target failed: boardroom-feature-timeline:build-storybook:ci
    at run (<...>\node_modules\@nx\web\src\executors\file-server\file-server.impl.js:138:27)
    at fileServerExecutor (<...>\node_modules\@nx\web\src\executors\file-server\file-server.impl.js:151:9)
    at fileServerExecutor.next (<anonymous>)
    at startDevServer (<...>\node_modules\@nx\cypress\src\utils\start-dev-server.js:38:22)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async cypressExecutor (<...>\node_modules\@nx\cypress\src\executors\cypress\cypress.impl.js:15:22)
    at async promiseToIterator (<...>\node_modules\nx\src\command-line\run\run.js:32:11)
    at async getLastValueFromAsyncIterableIterator (<...>\node_modules\nx\src\utils\async-iterator.js:13:19)
    at async iteratorToProcessStatusCode (<...>\node_modules\nx\src\command-line\run\run.js:43:29)
    at async handleErrors (<...>\node_modules\nx\src\utils\params.js:9:16)
    at async process.<anonymous> (<...>\node_modules\nx\bin\run-executor.js:59:28)

After removing the catch-clause, I got a better error message:

Error: spawnSync npx.cmd EINVAL
    at Object.spawnSync (node:internal/child_process:1124:20)
    at spawnSync (node:child_process:876:24)
    at execFileSync (node:child_process:919:15)
    at run (<...>\node_modules\@nx\web\src\executors\file-server\file-server.impl.js:133:54)
    at fileServerExecutor (<...>\node_modules\@nx\web\src\executors\file-server\file-server.impl.js:148:9)
    at fileServerExecutor.next (<anonymous>)
    at startDevServer (<...>\node_modules\@nx\cypress\src\utils\start-dev-server.js:38:22)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async cypressExecutor (<...>\node_modules\@nx\cypress\src\executors\cypress\cypress.impl.js:15:22)
    at async promiseToIterator (<...>\node_modules\nx\src\command-line\run\run.js:32:11)
    at async getLastValueFromAsyncIterableIterator (<...>\node_modules\nx\src\utils\async-iterator.js:13:19)
    at async iteratorToProcessStatusCode (<...>\node_modules\nx\src\command-line\run\run.js:43:29)
    at async handleErrors (<...>\node_modules\nx\src\utils\params.js:9:16)
    at async process.<anonymous> (<...>\node_modules\nx\bin\run-executor.js:59:28)

That led me to the following CVE from Node:
https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2#command-injection-via-args-parameter-of-child_processspawn-without-shell-option-enabled-on-windows-cve-2024-27980---high

As stated there, on Windows you need to pass shell: true when spawning a child process via Node for Node release after April 9, 2024, otherwise it will fail with EINVAL.

Expected Behavior

Using the @nx/web:file-server with a buildTarget on Windows should work.

GitHub Repo

No response

Steps to Reproduce

1. Create a build-target using the @nx/web:file-server executor
2. Add a buildTarget
3. Run the build-target on a Windows machine with a current Node release

Nx Report

Node   : 20.13.1
OS     : win32-x64
yarn   : 4.1.1-git.20240429.hash-2bef162e3

nx                 : 18.1.3
@nx/js             : 18.1.3
@nx/jest           : 18.1.3
@nx/linter         : 18.1.3
@nx/eslint         : 18.1.3
@nx/workspace      : 18.1.3
@nx/angular        : 18.1.3
@nx/cypress        : 18.1.3
@nx/devkit         : 18.1.3
@nx/eslint-plugin  : 18.1.3
@nx/plugin         : 18.1.3
@nx/storybook      : 18.1.3
@nrwl/tao          : 18.1.3
@nx/web            : 18.1.3
@nx/webpack        : 18.1.3
typescript         : 5.3.3
---------------------------------------
Community plugins:
@compodoc/compodoc                        : 1.1.24
@ng-bootstrap/ng-bootstrap                : 16.0.0
@ngrx/component-store                     : 17.2.0
@ngrx/effects                             : 17.2.0
@ngrx/entity                              : 17.2.0
@ngrx/operators                           : 17.2.0
@ngrx/router-store                        : 17.2.0
@ngrx/store                               : 17.2.0
@ngrx/store-devtools                      : 17.2.0
@progress/kendo-angular-buttons           : 14.3.0
@progress/kendo-angular-conversational-ui : 14.3.0
@progress/kendo-angular-dateinputs        : 14.3.0
@progress/kendo-angular-dialog            : 14.3.0
@progress/kendo-angular-dropdowns         : 14.3.0
@progress/kendo-angular-editor            : 14.3.0
@progress/kendo-angular-excel-export      : 14.3.0
@progress/kendo-angular-grid              : 14.3.0
@progress/kendo-angular-icons             : 14.3.0
@progress/kendo-angular-inputs            : 14.3.0
@progress/kendo-angular-intl              : 14.3.0
@progress/kendo-angular-l10n              : 14.3.0
@progress/kendo-angular-label             : 14.3.0
@progress/kendo-angular-layout            : 14.3.0
@progress/kendo-angular-menu              : 14.3.0
@progress/kendo-angular-navigation        : 14.3.0
@progress/kendo-angular-notification      : 14.3.0
@progress/kendo-angular-pdf-export        : 14.3.0
@progress/kendo-angular-popup             : 14.3.0
@progress/kendo-angular-progressbar       : 14.3.0
@progress/kendo-angular-sortable          : 14.3.0
@progress/kendo-angular-toolbar           : 14.3.0
@progress/kendo-angular-tooltip           : 14.3.0
@progress/kendo-angular-treeview          : 14.3.0
@progress/kendo-angular-upload            : 14.3.0
@progress/kendo-angular-utils             : 14.3.0
@storybook/angular                        : 8.1.1
@trumbitta/nx-plugin-unused-deps          : 1.12.1
apollo-angular                            : 7.0.1
---------------------------------------
Local workspace plugins:
         @evo/plugin

Failure Logs

Error: spawnSync npx.cmd EINVAL
    at Object.spawnSync (node:internal/child_process:1124:20)
    at spawnSync (node:child_process:876:24)
    at execFileSync (node:child_process:919:15)
    at run (<...>\node_modules\@nx\web\src\executors\file-server\file-server.impl.js:133:54)
    at fileServerExecutor (<...>\node_modules\@nx\web\src\executors\file-server\file-server.impl.js:148:9)
    at fileServerExecutor.next (<anonymous>)
    at startDevServer (<...>\node_modules\@nx\cypress\src\utils\start-dev-server.js:38:22)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async cypressExecutor (<...>\node_modules\@nx\cypress\src\executors\cypress\cypress.impl.js:15:22)
    at async promiseToIterator (<...>\node_modules\nx\src\command-line\run\run.js:32:11)
    at async getLastValueFromAsyncIterableIterator (<...>\node_modules\nx\src\utils\async-iterator.js:13:19)
    at async iteratorToProcessStatusCode (<...>\node_modules\nx\src\command-line\run\run.js:43:29)
    at async handleErrors (<...>\node_modules\nx\src\utils\params.js:9:16)
    at async process.<anonymous> (<...>\node_modules\nx\bin\run-executor.js:59:28)

Package Manager Version

No response

Operating System

• macOS
• Linux
• Windows
• Other (Please specify)

Additional Information

The incorrect code is in nx/packages/web/src/executors/file-server/file-server.impl.ts, lines 160-162:

          execFileSync(pmCmd, args, {
            stdio: [0, 1, 2],
          });

On Windows, pmCmd is npx.cmd. This will fail, due to the fixed CVE. A possible fix:

          const execOptions = platform() === 'win32' ? {
            stdio: [0, 1, 2],
            shell: true
          } : {
            stdio: [0, 1, 2],
          };
          execFileSync(pmCmd, args, execOptions);

As a sidenote, catching an error, but then just logging a generic "build target failed" (lines 163-166) is not very helpful when trying to find out why there was a failure.

[github-actions]

This issue has been closed for more than 30 days. If this issue is still occuring, please open a new issue with more recent context.