Launch correct fzf binary on Windows

CHANGELOG.md

@@ -28,6 +28,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Parse error on Cygwin/MSYS due to CRLF line endings.
 - Fzf: handle spaces correctly in preview window.
 - Bash: avoid initializing completions on older versions.
+- Fzf: avoid launching binary from current directory on Windows.
 
 ## [0.7.9] - 2021-11-02
 

Cargo.toml

@@ -27,6 +27,7 @@ glob = "0.3.0"
 ordered-float = "2.0.0"
 serde = { version = "1.0.116", features = ["derive"] }
 tempfile = "3.1.0"
+thiserror = "1.0.30"
 
 [target.'cfg(windows)'.dependencies]
 rand = { version = "0.8.4", features = [

src/db/mod.rs

@@ -120,6 +120,12 @@ impl<'file> Database<'file> {
     }
 }
 
+#[cfg(unix)]
+fn persist<P: AsRef<Path>>(file: NamedTempFile, path: P) -> Result<(), PersistError> {
+    file.persist(path)?;
+    Ok(())
+}
+
 #[cfg(windows)]
 fn persist<P: AsRef<Path>>(mut file: NamedTempFile, path: P) -> Result<(), PersistError> {
     use std::thread;
@@ -152,12 +158,6 @@ fn persist<P: AsRef<Path>>(mut file: NamedTempFile, path: P) -> Result<(), Persi
     Ok(())
 }
 
-#[cfg(unix)]
-fn persist<P: AsRef<Path>>(file: NamedTempFile, path: P) -> Result<(), PersistError> {
-    file.persist(path)?;
-    Ok(())
-}
-
 pub struct DatabaseFile {
     buffer: Vec<u8>,
     data_dir: PathBuf,

src/error.rs

@@ -1,20 +1,19 @@
-use std::fmt::{self, Display, Formatter};
 use std::io;
 
 use anyhow::{bail, Context, Result};
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+#[error("could not find fzf, is it installed?")]
+pub struct FzfNotFound;
 
 /// Custom error type for early exit.
-#[derive(Debug)]
+#[derive(Debug, Error)]
+#[error("")]
 pub struct SilentExit {
     pub code: i32,
 }
 
-impl Display for SilentExit {
-    fn fmt(&self, _: &mut Formatter) -> fmt::Result {
-        Ok(())
-    }
-}
-
 pub trait BrokenPipeHandler {
     fn pipe_exit(self, device: &str) -> Result<()>;
 }

src/fzf.rs

@@ -1,19 +1,20 @@
 use std::io::{self, Read};
 use std::mem;
-use std::process::{Child, ChildStdin, Command, Stdio};
+use std::process::{Child, ChildStdin, Stdio};
 
 use anyhow::{bail, Context, Result};
 
-use crate::config;
-use crate::error::SilentExit;
+use crate::error::{FzfNotFound, SilentExit};
+use crate::{config, util};
 
 pub struct Fzf {
     child: Child,
 }
 
 impl Fzf {
     pub fn new(multiple: bool) -> Result<Self> {
-        let mut command = Command::new("fzf");
+        let bin = if cfg!(windows) { "fzf.exe" } else { "fzf" };
+        let mut command = util::get_command(bin).map_err(|_| FzfNotFound)?;
         if multiple {
             command.arg("-m");
         }
@@ -37,9 +38,7 @@ impl Fzf {
 
         let child = match command.spawn() {
             Ok(child) => child,
-            Err(e) if e.kind() == io::ErrorKind::NotFound => {
-                bail!("could not find fzf, is it installed?")
-            }
+            Err(e) if e.kind() == io::ErrorKind::NotFound => bail!(FzfNotFound),
             Err(e) => Err(e).context("could not launch fzf")?,
         };
 

src/util.rs

@@ -1,5 +1,6 @@
 use std::env;
 use std::path::{Component, Path, PathBuf};
+use std::process::Command;
 use std::time::SystemTime;
 
 use anyhow::{bail, Context, Result};
@@ -21,6 +22,35 @@ pub fn current_time() -> Result<Epoch> {
     Ok(current_time)
 }
 
+/// Constructs a new [`Command`] for launching the program with the name
+/// `program`.
+///
+/// On Windows, CreateProcess implicitly searches the current working directory
+/// for the executable, which is a potential security issue. Instead, we resolve
+/// the path to the executable and then pass it to CreateProcess.
+///
+/// On other platforms, this is a no-op.
+///
+pub fn get_command<P: AsRef<Path>>(program: P) -> Result<Command> {
+    let program = program.as_ref();
+    if !cfg!(windows) {
+        return Ok(Command::new(program));
+    }
+
+    let paths = env::var_os("PATH").context("PATH environment variable not set")?;
+    for path in env::split_paths(&paths) {
+        if path.as_os_str().is_empty() {
+            continue;
+        }
+        let path = path.join(program);
+        if path.metadata().map_or(false, |m| !m.is_dir()) {
+            return Ok(Command::new(path));
+        }
+    }
+
+    bail!("executable not found in PATH: {}", program.display());
+}
+
 pub fn path_to_str<P: AsRef<Path>>(path: &P) -> Result<&str> {
     let path = path.as_ref();
     path.to_str().with_context(|| format!("invalid unicode in path: {}", path.display()))