Regression in 3.1.4: file:import rejects valid File Cabinet paths containing & (safe under new shell: false spawn)

[NetCompassTech]

Select the SuiteCloud tool where you encountered the issue

SuiteCloud CLI

Version of the SuiteCloud Tool

3.2.0

Operating system

Alpine Linux 3.19 (Docker, node:22.4-alpine3.19)

Node Version / VSCode Version

v22.4

JAVA Version

OpenJDK 17

Bug description

Since CLI 3.1.4, suitecloud file:import rejects --paths values that point to File Cabinet files whose paths contain characters in the new blocklist — in particular &. These are legitimate, long-standing File Cabinet paths (e.g. folders named Cut & Dry or Auto Calc Weight & Cases) that imported successfully on 3.1.3 and earlier.

The command fails with:

Invalid characters were found in the value "/SuiteScripts/Auto Calc Weight & Cases/aut_calc_weight_UE_soto.js" for parameter name "-paths". Control characters (U+0000-U+001F, U+007F) and the following symbols are not supported: <>|;&$`
I traced this to packages/node-cli/src/SdkExecutor.js, introduced in PR #1040 ("remove the use of shell:true and path sanitization"). The validation regex in ApplicationConstants.js is:

SDK_EXECUTOR_NON_ALLOWED_PARAMETERS_REGEX : /[\u0000-\u001F\u007F<>|;&$]/ My concern: the same PR correctly switched the child process from spawn(..., { shell: true }) to spawn('java', args, { shell: false }). Once there is no shell, characters like &, $, are no longer special — they are passed to Java as literal argv strings and pose no injection risk. So blocking & in a --paths value is now rejecting input that is both safe and valid: & is an allowed character in the NetSuite File Cabinet, and files containing it exist in real accounts. The blocklist appears intended for shell metacharacter safety, but it's now applied to arguments that never touch a shell, which breaks legitimate imports.

Request: please don't reject these characters for path-type parameters (or at least &) when spawning without a shell, since they can't cause command injection in that mode.

Steps To Reproduce

1. Use SuiteCloud CLI 3.1.4 or 3.2.0.
2. Have a File Cabinet file whose path contains &, e.g. /SuiteScripts/Cut & Dry/example.js.
3. Run: suitecloud file:import --paths "/SuiteScripts/Cut & Dry/example.js"
4. See the "Invalid characters were found" error; the file is not imported.
5. Repeat on 3.1.3 → the import succeeds.

Actual Output

The imported files will overwrite the project files
Invalid characters were found in the value "/SuiteScripts/Auto Calc Weight & Cases/aut_calc_weight_UE_soto.js" for parameter name "-paths". Control characters (U+0000-U+001F, U+007F) and the following symbols are not supported: <>|;&$`

Expected Output

The files import successfully, as they did on 3.1.3 and earlier. & (and other characters that are only special to a shell) should be accepted in path parameters now that the CLI spawns Java with shell: false.

Anything else?

First appeared in @oracle/suitecloud-cli@3.1.4 (published 2026-06-09). Last working version: 3.1.3 (2026-05-20).
Introduced by PR #1040 / commit 779b705 ("remove the use of shell:true and path sanitization").
Relevant code: SdkExecutor.js (_validateExecutionArgs, _getExecutionParams) and SDK_EXECUTOR_NON_ALLOWED_PARAMETERS_REGEX in ApplicationConstants.js.
Reference: NetSuite docs do flag & as "unsupported in file names," but existing accounts contain such files and they were importable until 3.1.4, so this is a regression in practice.

[veronicacbs]

Hi @NetCompassTech ,

Thank you for reporting this issue and for the detailed investigation. We really appreciate the time you took to analyze the regression and share your findings.

We've acknowledged the report and will investigate it. We'll keep the issue updated as we have more information.

Thanks again for helping us improve SuiteCloud CLI!