Repository: symfony/symfony
File: src/Symfony/Component/Scheduler/DependencyInjection/AddScheduleMessengerPass.php (PHP)

Code before:
        }

        $scheduleProviderIds = [];
        foreach ($container->findTaggedServiceIds('scheduler.schedule_provider') as $serviceId => $tags) {
            $name = $tags[0]['name'];
            $scheduleProviderIds[$name] = $serviceId;
        }

        $tasksPerSchedule = [];
        foreach ($container->findTaggedServiceIds('scheduler.task') as $serviceId => $tags) {
            foreach ($tags as $tagAttributes) {
                $serviceDefinition = $container->getDefinition($serviceId);
                $scheduleName = $tagAttributes['schedule'] ?? 'default';

                if ($serviceDefinition->hasTag('console.command')) {
                    /** @var AsCommand|null $attribute */
                    $attribute = ($container->getReflectionClass($serviceDefinition->getClass())->getAttributes(AsCommand::class)[0] ?? null)?->newInstance();
                    $commandName = $attribute?->name ?? $serviceDefinition->getClass()::getDefaultName();

                    $arguments = $tagAttributes['arguments'] ?? null;
                    if (\is_array($arguments)) {
                        $arguments = implode(' ', array_map(
                            static fn ($token) => preg_match('{^[\w-]+$}', $token = (string) $token) ? $token : escapeshellarg($token),
                            $arguments
                        ));
                    }
                    $message = new Definition(RunCommandMessage::class, [$commandName.($arguments ? " $arguments" : '')]);
                } else {
                    $message = new Definition(ServiceCallMessage::class, [$serviceId, $tagAttributes['method'] ?? '__invoke', (array) ($tagAttributes['arguments'] ?? [])]);
                }

                if ($tagAttributes['transports'] ?? null) {
                    $message = new Definition(RedispatchMessage::class, [$message, $tagAttributes['transports']]);
                }

                $taskArguments = [
                    '$message' => $message,
                ] + array_filter(match ($tagAttributes['trigger'] ?? throw new InvalidArgumentException(\sprintf('Tag "scheduler.task" is missing attribute "trigger" on service "%s".', $serviceId))) {
                    'every' => [
                        '$frequency' => $tagAttributes['frequency'] ?? throw new InvalidArgumentException(\sprintf('Tag "scheduler.task" is missing attribute "frequency" on service "%s".', $serviceId)),
                        '$from' => $tagAttributes['from'] ?? null,
                        '$until' => $tagAttributes['until'] ?? null,
                    ],
                    'cron' => [
                        '$expression' => $tagAttributes['expression'] ?? throw new InvalidArgumentException(\sprintf('Tag "scheduler.task" is missing attribute "expression" on service "%s".', $serviceId)),
                        '$timezone' => $tagAttributes['timezone'] ?? null,
                    ],
                }, fn ($value) => null !== $value);

                $tasksPerSchedule[$scheduleName][] = $taskDefinition = (new Definition(RecurringMessage::class))
                    ->setFactory([RecurringMessage::class, $tagAttributes['trigger']])

Review comment (security):
```
                    if (\is_array($arguments = $tagAttributes['arguments'] ?? null)) {
                        $arguments = implode(' ', array_map(static fn (string $token) => preg_match('{^[\w-]+$}', $token) ? $token : escapeshellarg($token), $arguments));
                    }
```

Code after:

        $scheduleProviderIds = [];
        foreach ($container->findTaggedServiceIds('scheduler.schedule_provider') as $serviceId => $tags) {
            $name = $tags[0]['name'];
            $scheduleProviderIds[$name] = $serviceId;
        }

        $tasksPerSchedule = [];
        foreach ($container->findTaggedServiceIds('scheduler.task') as $serviceId => $tags) {
            foreach ($tags as $tagAttributes) {
                $serviceDefinition = $container->getDefinition($serviceId);
                $scheduleName = $tagAttributes['schedule'] ?? 'default';

                if ($serviceDefinition->hasTag('console.command')) {
                    if (\is_array($arguments = $tagAttributes['arguments'] ?? '')) {
                        $arguments = implode(' ', array_map(static fn (string $token) => preg_match('{^[\w-]+$}', $token) ? $token : escapeshellarg($token), $arguments));
                    }
		    $message = new Definition(RunCommandMessage::class, [$serviceDefinition->getClass()::getDefaultName().('' !== $arguments ? " $arguments" : '')]);
                } else {
                    $message = new Definition(ServiceCallMessage::class, [$serviceId, $tagAttributes['method'] ?? '__invoke', (array) ($tagAttributes['arguments'] ?? [])]);
                }

                if ($tagAttributes['transports'] ?? null) {
                    $message = new Definition(RedispatchMessage::class, [$message, $tagAttributes['transports']]);
                }

                $taskArguments = [
                    '$message' => $message,
                ] + array_filter(match ($tagAttributes['trigger'] ?? throw new InvalidArgumentException(\sprintf('Tag "scheduler.task" is missing attribute "trigger" on service "%s".', $serviceId))) {
                    'every' => [
                        '$frequency' => $tagAttributes['frequency'] ?? throw new InvalidArgumentException(\sprintf('Tag "scheduler.task" is missing attribute "frequency" on service "%s".', $serviceId)),
                        '$from' => $tagAttributes['from'] ?? null,
                        '$until' => $tagAttributes['until'] ?? null,
                    ],
                    'cron' => [
                        '$expression' => $tagAttributes['expression'] ?? throw new InvalidArgumentException(\sprintf('Tag "scheduler.task" is missing attribute "expression" on service "%s".', $serviceId)),
                        '$timezone' => $tagAttributes['timezone'] ?? null,
                    ],
                }, fn ($value) => null !== $value);

                $tasksPerSchedule[$scheduleName][] = $taskDefinition = (new Definition(RecurringMessage::class))
                    ->setFactory([RecurringMessage::class, $tagAttributes['trigger']])
                    ->setArguments($taskArguments);

                if ($tagAttributes['jitter'] ?? false) {
                    $taskDefinition->addMethodCall('withJitter', [$tagAttributes['jitter']], true);
                }
            }
        }

        foreach ($tasksPerSchedule as $scheduleName => $tasks) {