Skip to content

uucore: use single quotes for shell-quoted names containing '!' - #15879

Open
fixfon wants to merge 1 commit into
uutils:mainfrom
fixfon:fix/15812-shell-quote-bang
Open

fixfon wants to merge 1 commit into
uutils:mainfrom
fixfon:fix/15812-shell-quote-bang

Conversation

@fixfon

@fixfon fixfon commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

Fixes #15812

initial_quoting in shell_quoter.rs picks the quote character once. A name with ' and no other character from shell_escaped_char_set got double quotes, but ! is not in that set. An interactive bash expands ! inside double quotes, so ls on a file named x!#;touch PWNED;#' printed "x!#;touch PWNED;#'", and pasting that at a prompt runs the tail as a command. a'!b printed "a'!b", which fails with event not found. ! already counts as a special character in escaped_char.rs, but that only forces quoting; it never changes the quote kind.

I added ! to ESCAPED_CHARS, at the end because shell_escaped_char_set drops the first byte (:) for names that are not directories. A name with both ' and ! is now single-quoted with the apostrophe written as '\'', in all four shell styles and for printf %q and stat -c %N. Names with only ! or only ' print as before.

Tests: initial_quoting and test_special_chars_in_double_quotes in quoting_style, one ls test (file and -R heading) and one printf %q case. They fail on current main and pass with this change. cargo fmt, root cargo clippy --all-targets -- -D warnings, cargo test -p uucore quoting_style and the ls, printf and stat integration tests pass. Tested on macOS only.

Interactive bash history-expands `!` inside double quotes, so a name with
both `'` and `!` printed as a double-quoted string can run a command when
pasted. Adding `!` to the characters that force single quotes fixes all
four shell styles.

Fixes uutils#15812

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

quoting_style: ! in double quotes allows command injection when pasted

1 participant