Repository navigation
Conversation
Interactive bash history-expands `!` inside double quotes, so a name with both `'` and `!` printed as a double-quoted string can run a command when pasted. Adding `!` to the characters that force single quotes fixes all four shell styles. Fixes uutils#15812
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #15812
initial_quotinginshell_quoter.rspicks the quote character once. A name with'and no other character fromshell_escaped_char_setgot double quotes, but!is not in that set. An interactive bash expands!inside double quotes, solson a file namedx!#;touch PWNED;#'printed"x!#;touch PWNED;#'", and pasting that at a prompt runs the tail as a command.a'!bprinted"a'!b", which fails withevent not found.!already counts as a special character inescaped_char.rs, but that only forces quoting; it never changes the quote kind.I added
!toESCAPED_CHARS, at the end becauseshell_escaped_char_setdrops the first byte (:) for names that are not directories. A name with both'and!is now single-quoted with the apostrophe written as'\'', in all four shell styles and forprintf %qandstat -c %N. Names with only!or only'print as before.Tests:
initial_quotingandtest_special_chars_in_double_quotesinquoting_style, onelstest (file and-Rheading) and oneprintf %qcase. They fail on current main and pass with this change.cargo fmt, rootcargo clippy --all-targets -- -D warnings,cargo test -p uucore quoting_styleand thels,printfandstatintegration tests pass. Tested on macOS only.