I assume this is a Candle issue rather than a Light issue.
When using a CustomAction with the ExeCommand attribute the Directory attribute is not required. If you fail to provide the Directory attribute Light generates the following error message:
error LGHT0204 : ICE03: Not a valid foreign key; Table: CustomAction, Column: Target, Key(s): AllowPOST
Source:
<customaction id="user-content-AllowProxy" execommand="<span>[SystemFolder]</span>netsh.exe firewall set allowedprogram "<span>[#EmbeddedProxy.exe]</span>" "Embedded Proxy" ENABLE" return="ignore"></customaction>
Workaround is to simply provide a Directory attribute.
<customaction id="user-content-AllowProxy" directory="EmbeddedProxyDir" execommand="<span>[SystemFolder]</span>netsh.exe firewall set allowedprogram "<span>[#EmbeddedProxy.exe]</span>" "Embedded Proxy" ENABLE" return="ignore"></customaction>
Build: 4123
Logged In: YES
user_id=26581
Originator: NO
Directory is required only when you want to execute an arbitrary command line. Other options include FileKey and Property. When one of those is omitted, there should be an error.
However, WixFirewallExtension handles the firewall in a fully declarative manner, so you should consider switching to it instead of arbitrary exe custom actions.
Logged In: YES
user_id=991639
Originator: NO
Added a better error message for this case.
This Tracker item was closed automatically by the system. It was
previously set to a Pending status, and the original submitter
did not respond within 15 days (the time period specified by
the administrator of this Tracker).