macOS dev-certs - Handle keychain paths with spaces (#43120)

Author: adityamandaleeka

src/Shared/CertificateGeneration/MacOSCertificateManager.cs

@@ -13,6 +13,8 @@ namespace Microsoft.AspNetCore.Certificates.Generation;
 
 internal sealed class MacOSCertificateManager : CertificateManager
 {
+    // User keychain. Guard with quotes when using in command lines since users may have set
+    // their user profile (HOME) directory to a non-standard path that includes whitespace.
     private static readonly string MacOSUserKeychain = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "/Library/Keychains/login.keychain-db";
 
     // System keychain. We no longer store certificates or create trust rules in the system
@@ -25,34 +27,34 @@ internal sealed class MacOSCertificateManager : CertificateManager
 
     // Verify the certificate {0} for the SSL and X.509 Basic Policy.
     private const string MacOSVerifyCertificateCommandLine = "security";
-    private const string MacOSVerifyCertificateCommandLineArgumentsFormat = $"verify-cert -c {{0}} -p basic -p ssl";
+    private const string MacOSVerifyCertificateCommandLineArgumentsFormat = "verify-cert -c \"{0}\" -p basic -p ssl";
 
     // Delete a certificate with the specified SHA-256 (or SHA-1) hash {0} from keychain {1}.
     private const string MacOSDeleteCertificateCommandLine = "sudo";
-    private const string MacOSDeleteCertificateCommandLineArgumentsFormat = "security delete-certificate -Z {0} {1}";
+    private const string MacOSDeleteCertificateCommandLineArgumentsFormat = "security delete-certificate -Z {0} \"{1}\"";
 
     // Add a certificate to the per-user trust settings in the user keychain. The trust policy
     // for the certificate will be set to be always trusted for SSL and X.509 Basic Policy.
     // Note: This operation will require user authentication.
     private const string MacOSTrustCertificateCommandLine = "security";
-    private static readonly string MacOSTrustCertificateCommandLineArguments = $"add-trusted-cert -p basic -p ssl -k {MacOSUserKeychain} ";
+    private static readonly string MacOSTrustCertificateCommandLineArguments = $"add-trusted-cert -p basic -p ssl -k \"{MacOSUserKeychain}\" ";
 
     // Import a pkcs12 certificate into the user keychain using the unwrapping passphrase {1}, and
     // allow any application to access the imported key without warning.
     private const string MacOSAddCertificateToKeyChainCommandLine = "security";
-    private static readonly string MacOSAddCertificateToKeyChainCommandLineArgumentsFormat = "import {0} -k " + MacOSUserKeychain + " -t cert -f pkcs12 -P {1} -A";
+    private static readonly string MacOSAddCertificateToKeyChainCommandLineArgumentsFormat = "import \"{0}\" -k \"" + MacOSUserKeychain + "\" -t cert -f pkcs12 -P {1} -A";
 
     // Remove a certificate from the admin trust settings. We no longer add certificates to the
     // admin trust settings, but need this for cleaning up certs generated by pre-.NET 7 versions
     // of this tool that used to create trust settings in the system keychain.
     // Note: This operation will require user authentication.
     private const string MacOSUntrustLegacyCertificateCommandLine = "sudo";
-    private const string MacOSUntrustLegacyCertificateCommandLineArguments = "security remove-trusted-cert -d {0}";
+    private const string MacOSUntrustLegacyCertificateCommandLineArguments = "security remove-trusted-cert -d \"{0}\"";
 
     // Find all matching certificates on the keychain {1} that have the name {0} and print
     // print their SHA-256 and SHA-1 hashes.
     private const string MacOSFindCertificateOnKeychainCommandLine = "security";
-    private const string MacOSFindCertificateOnKeychainCommandLineArgumentsFormat = "find-certificate -c {0} -a -Z -p {1}";
+    private const string MacOSFindCertificateOnKeychainCommandLineArgumentsFormat = "find-certificate -c {0} -a -Z -p \"{1}\"";
 
     // Format used by the tool when printing SHA-1 hashes.
     private const string MacOSFindCertificateOutputRegex = "SHA-1 hash: ([0-9A-Z]+)";