Skip to content

Get-Process CommandLine property gets truncated if it contains a newline character on Linux #27499

@kevin-hoffman

Description

@kevin-hoffman

Prerequisites

Steps to reproduce

On Linux, from a regular (non-PowerShell) shell, run the following command. Note that this is a two-line command in order to embed a newline character into the command line. For instance in bash, after you type the first line, a continuation prompt > will appear, and from there type the second line. Or you can put these two lines in a file as a script, make it executable, and run it that way.

pwsh -Command "(Get-Process -Id \"\$pid\").CommandLine; \$testVar=\"
\""

(While the example above is certainly contrived, this issue has been tripping up our security scanning software application which can't find a running Tomcat process due to a newline character that's embedded in its command line)

Expected behavior

Since this command prints its own process's command line, the output should be the exact command line that was given (including the newline), minus some of the quoting (see discussion of quoting and escaping in #13944)

pwsh -Command (Get-Process -Id "$pid").CommandLine; $testVar="
"

Actual behavior

Due to this issue, the command line ends up getting truncated, yet still multi-line.

p
"

Cause

This issue happens because in the GetScriptBlock of the @CommandLine property there is the following code:

$rawCmd = Get-Content -LiteralPath ""/proc/$($this.Id)/cmdline""
$rawCmd.Substring(0, $rawCmd.Length - 1) -replace ""`0"", "" ""

which pulls the command line from the virtual file /proc/PID/cmdline and then replaces null characters with spaces. This works fine unless there is a newline character in the file. If a newline character is in the file, then Get-Content returns an array of String objects rather than a single String object. Because of this, the $rawCmd.Length property no longer returns the length of the String, but rather the length of the array of Strings, which is likely a much smaller value and truncates the String. It also changes the type of the CommandLine property to an array of Strings instead of a String which is also not desired.

Suggested fix

Adding the -Raw flag to the Get-Content line above fixes the issue by ensuring Get-Content returns everything as a single string even if there are embedded newline characters in what it reads in.

Environment data

Name                           Value
----                           -----
PSVersion                      7.6.1
PSEdition                      Core
GitCommitId                    7.6.1
OS                             Debian GNU/Linux 12 (bookworm)
Platform                       Unix
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.4
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Metadata

Metadata

Assignees

No one assigned

    Labels

    Needs-TriageThe issue is new and needs to be triaged by a work group.

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions