Build failure in 4.x branch code

[tylerablackham]

I'm running into some issues building the code when I'm in the 4.x branch. From a new clone of the repo, I follow the instructions in the CONTRIBUTING.md file:

• I run npm install
• I clone the mustache spec
• Once I run grunt, the build fails:

$ grunt 
Running "clean:0" (clean) task
>> 0 paths cleaned.

Running "clean:1" (clean) task
>> 0 paths cleaned.

Running "clean:2" (clean) task
>> 0 paths cleaned.

Running "clean:3" (clean) task
>> 0 paths cleaned.

Running "parser" task
Fatal error: spawn EINVAL

I'm able to build fine when I'm in the master branch, but not when I'm in the 4.x branch. What can I do to fix this?

[jaylinski]

What Node version are you using?

[tylerablackham]

@jaylinski I tried building in v22.20.0 and v18.20.8

[jaylinski]

Hm. Build works for me when I run npm run build. Can you try that?

[tylerablackham]

@jaylinski When I run npm run build, the same thing happens. Tried it in node 18, 20, and 22

$ npm run build

> [email protected] build
> grunt build

Running "parser" task
Fatal error: spawn EINVAL

[tylerablackham]

@jaylinski I got it working by doing the following:

• running npm install --save-dev jison
• updating the runJison() function in tasks/parser.js to point to the jison cli

    const jisonBin = require.resolve('jison/lib/cli');
    await execFileWithInheritedOutput(process.execPath, [
      jisonBin,
      '-m',
      'js',
      'src/handlebars.yy',
      'src/handlebars.l'
    ]);

Do you want me to create a PR for this fix?

[jaylinski]

Did you run this on Windows?

[tylerablackham]

Yes

[jaylinski]

Okay, now I understand why I couldn't reproduce it. Yes, please open a PR by fixing the spawn-issue as described here:

https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2#command-injection-via-args-parameter-of-child_processspawn-without-shell-option-enabled-on-windows-cve-2024-27980---high