Bug ID: JDK-8014730 7u21 change to Runtime.exec breaks Maven execution in NetBeans

Type: Bug
Component: core-libs
Sub-Component: java.lang
Affected Version: 7u21

Priority: P2
Status: Resolved
Resolution: Won't Fix
OS: windows

Submitted: 2013-05-16
Updated: 2013-06-17
Resolved: 2013-06-17

In netbeans we are using java.lang.ProcessBuilder.start() to execute maven builds. Since 7u21 the process fails on windows in some specific cases. eg. we pass a system property to maven -Dexec.args=<value> to instruct the maven exec plugin to execute another JVM. <value> in this case can contain multiple parameters for java.exe including those that have space in the value, for example when profiling an app, we pass -agentpath:<path> where path points to a path within netbeans and in most cases contains spaces. More details are available in the NetBeans bug referred below.

The 7u21 update release notes mention that ProcessBuilder should be used instead of Runtime.exec(). We are already using ProcessBuilder.start() but experience the same issue.

Please advice how to proceed or fix this regression on Java side in the next 7uX update.

Related NetBeans bug:
https://netbeans.org/bugzilla/show_bug.cgi?id=228901

The regression was workarounded in NetBeans code using "cmd /c" in 7.4 version (Beta to be released soon).
17-06-2013
We recently found out that NetBeans does run with a security manager so it looks like the only solution is to fix the usage in NetBeans.
03-06-2013
Alan, here is another sort of problem. As I mentioned it in my comment: "MS has special quotation syntax for .BAT and .CMD files that is different from console application (doubling, not escaping) . Java WILL NOT fix that issue due to security reasons. The log contains valid workaround description: java.lang.IllegalArgumentException: Argument has embedded quote, use the explicit CMD.EXE call." There are two valid workarounds: 1) Implicit call of command processor cmd.exe 2) (if there is no Security Manager) Use the programmatically installed "jdk.lang.Process.allowAmbigousCommands" property.
03-06-2013
The code in NetBeans already uses ProcessBuilder as mentioned in the description with some details and the code is here: http://hg.netbeans.org/core-main/file/tip/maven/src/org/netbeans/modules/maven/execute/MavenCommandLineExecutor.java#l456
31-05-2013
If NetBeans is running with a security manager then it will either need to quote the command (to disambiguate the command from the arguments) or alternatively switch to use ProcessBuilder or the array form of Runtime.exec.
31-05-2013
Still not working with 7u25 b13. Also the parameter jdk.lang.Process.allowAmbigousCommands does not help, probably because NetBeans has a Security Manager defined.
31-05-2013
Seems it has to be closed as "will not fixed". There is workaround in 7u25.
20-05-2013
Cannot confirm with 7u25 b11 as there is a critical issue for NetBeans since b10. See JDK-8014718.
20-05-2013
In accordance with log, the command file [C:\\Program Files\\NetBeans Dev201305062300\\java\\maven\\bin\\mvn.bat] is trying to be executed with the parameters that have internal quotation ["-Dexec.args=-agentpath:\\\"C:/usr/local/NetBeans 7.3.1 Dev/profiler/lib/deployed/jdk16/windows-amd64/profilerinterface.dll\\\"=\\\"C:\\usr\\local\\NetBeans 7.3.1 Dev\\profiler\\lib\\\"]. MS has special quotation syntax for .BAT and .CMD files that is different from console application (doubling, not escaping) . Java WILL NOT fix that issue due to security reasons. The log contains valid workaround description: java.lang.IllegalArgumentException: Argument has embedded quote, use the explicit CMD.EXE call. The alternative workaround for 7u25 for Java application that works without the Security Manager: the "jdk.lang.Process.allowAmbigousCommands" Java property could be defined programmatically or by program switch [-Djdk.lang.Process.allowAmbigousCommands]. Definition of the property returns old verification procedure for program name and program arguments with full risk of security vulnerabilities.
17-05-2013
I will let you know.
17-05-2013
Can you past in the output of "java -version" as it's not clear if you are testing with a 7u25 build that has changes for JDK-8012453.
17-05-2013
Reopening based on more information from the engineer working on the NB bug: > 1. Move to ProcessBuilder or use a Runtime.exec variant that allows the commands/arguments > to be specified in an array please see the netbeans.org issue referenced from the stack trace that shows that we ARE using ProcessBuilder or see http://hg.netbeans.org/core-main/file/ce0d57b59b1d/maven/src/org/netbeans/modules/maven/execute/MavenCommandLineExecutor.java around line 209. The problem appears not because the executable (first item in the List<String> passed to ProcessBuilder) is placed in embedded quotes, but when one of the successive parameters (3rd, 4th item in the list) has embedded quotes. e.g. The executed user application when profiled needs to start with these parameters (this comes from a mac, no windows paths) -agentpath:"/Applications/NetBeans/NetBeans Dev 201305082300.app/Contents/Resources/NetBeans/profiler/lib/deployed/jdk16/mac/libprofilerinterface.jnilib"="/Applications/NetBeans/NetBeans Dev 201305082300.app/Contents/Resources/NetBeans/profiler/lib",5140,10 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/Users/mkleint/Library/Caches/NetBeans/dev/mavencachedirs/450362382/org-netbeans-modules-profiler -classpath %classpath com.oracle.mavenproject31.App so it starts java binary and executes the App class with the right classpath and profiling parameters. Please note that -agentpath contains spaces in path to the jnilib file Then we need to wrap all of this into a single property that is recognised by maven's exec plugin -Dexec.args=<all of the above> and all that is passed as a single entry in the List<String> passed to ProcessBuilder. I'm reopening the issue because we are doing what you suggest and it doesn't work. The embedded quotes problem is not limited to Runtime.exec(String) but applies to ProcessBuilder as well. Includes not only the executable parameter but all of the parameters passed to ProcessBuilder.
17-05-2013
Please see 7u21 release notes. Also see JDK-8012453 where there are changes in 8 and 7uX to help legacy cases. In summary, fix by one of: 1. Move to ProcessBuilder or use a Runtime.exec variant that allows the commands/arguments to be specified in an array, or 2. Put quotes around the command so that it clearly delineates which is the command part of the String, or 3. When in desperation (can't change the code) then use the jdk.lang.Process.allowAmbigousCommands property to let Windows disambiguate the input and decide the command to run. This is not an option when running with a security manager, the security risk is too high.
16-05-2013