1

I havent used powershell a lot, so i am running into an issue with the argument GROUPING_TAGS. Can anyone please tell me what is wrong here? It works if i remove the grouping_tag argument.

Set-StrictMode -Version 2.0
$ErrorActionPreference = 'Stop'
$file = "C:\Users\xxxx\Desktop\test.exe"
$command = "Start-Process $file @('/install', '/quiet', '/norestart', 'CID=xxxxxxxxxxxx-123', 'GROUPING_TAGS=”Apple,Banana”')"
 
Invoke-Expression $command
OK999
  • 1,353
  • 2
  • 19
  • 39
  • 1
    Is there any specific reason you're using `Invoke-Expression` instead of calling `Start-Process` directly? – Mathias R. Jessen Sep 09 '20 at 21:27
  • 1
    You are using curly quotes in `GROUPING_TAGS`. Why not use straight double quotes and escape them? --> `'GROUPING_TAGS=""Apple,Banana""'` – AdminOfThings Sep 09 '20 at 21:28
  • @MathiasR.Jessen - thanks for the suggestion, i will try that out. I am still not very familiar with powershell. What is the drawback of calling `Invoke-Expression` into the `Start-Process`? – OK999 Sep 09 '20 at 21:33
  • 1
    @OK999 As you've just found out, it means you need to doubly escape strings. It also obscures error details (should an error occur), and it opens you up to injection attacks if you ever decide to include caller-controlled input of any kind. – Mathias R. Jessen Sep 09 '20 at 21:35

2 Answers2

2

Note:

  • Invoke-Expression should generally be avoided and used only as a last resort, due to its inherent security risks. In short: Avoid it, if possible, given that superior alternatives are usually available. If there truly is no alternative, only ever use it on input you either provided yourself or fully trust - see this answer.

  • Unless you want to execute test.exe asynchronously, in a new window, also do not use Start-Process - use direct invocation instead (& $file ....); see this answer for more information.

In your case, call Start-Process directly, with a single (positionally implied) -ArgumentList / -Args argument string containing all arguments:

$file = "C:\Users\xxxx\Desktop\test.exe"
Start-Process $file '/install /quiet /norestart CID=xxxxxxxxxxxx-123 GROUPING_TAGS="Apple,Banana"'

Note: It is a bug in Start-Process that makes passing all arguments as a single string rather than as an array of individual arguments preferable, as explained in this answer.

mklement0
  • 382,024
  • 64
  • 607
  • 775
-1

I figured it out. had to to put a back ticks infront of the "

Set-StrictMode -Version 2.0
$ErrorActionPreference = 'Stop'
$file = "C:\Users\xxxx\Desktop\test.exe"
$command = "Start-Process $file @('/install', '/quiet', '/norestart', 'CID=xxxxxxxxxxxx-123', 'GROUPING_TAGS=`”Apple,Banana`”')"
 
Invoke-Expression $command
Mathias R. Jessen
  • 157,619
  • 12
  • 148
  • 206
OK999
  • 1,353
  • 2
  • 19
  • 39
  • 1
    `Invoke-Expression` should generally be _avoided_ and used only as a _last resort_, due to its inherent security risks. In short: Avoid it, if possible, given that superior alternatives are usually available. If there truly is no alternative, only ever use it on input you either provided yourself or fully trust - see [this answer](https://stackoverflow.com/a/51252636/45375). – mklement0 Sep 09 '20 at 21:32