Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

login: fix argument escaping #458

Merged
merged 1 commit into from
Oct 20, 2024
Merged

login: fix argument escaping #458

merged 1 commit into from
Oct 20, 2024

Conversation

champignoom
Copy link
Contributor

Fixes #455

@sylirre sylirre merged commit b8e94ca into termux:master Oct 20, 2024
@sylirre
Copy link
Member

sylirre commented Oct 20, 2024

Thanks, this approach seems to be much better

done
set -- "-c" "${login_shell_args[*]}"
# Escape each argument to prevent word splitting.
set -- "-c" "$(printf " %q" "$@")"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Big +1 for using %q1

// man 1 bash
%q     causes printf to output the corresponding argument in a
       format that can be reused as shell input.

Another alternative that avoids the need for a command substitution
would have been to use ${@@Q}2.
Which is admittedly sort of weird syntax.
But quoting from the man page again:

${parameter@operator}
Parameter transformation.  The expansion is either a
transformation of the value of parameter or information about
parameter itself, depending on the value of operator.  Each
operator is a single letter:

// [...]

Q      The expansion is a string that is the value of parameter
       quoted in a format that can be reused as input.

// [...]

If parameter is @ or *, the operation is applied to each
positional parameter in turn, and the expansion is the resultant
list.  If parameter is an array variable subscripted with @ or
*, the operation is applied to each member of the array in turn,
and the expansion is the resultant list.

The result of the expansion is subject to word splitting and
pathname expansion as described below.

I don't think it's a big enough deal to go and fix it now after the fact,
printf %q does the same job after all, but the ${parameter@operator} expansions are good to have in the back of the head while writing Bash.

Footnotes

  1. https://www.man7.org/linux/man-pages/man1/bash.1.html#SHELL_BUILTIN_COMMANDS:~:text=status%20is%200.-,printf,-%5B%2Dv%20var

  2. https://www.man7.org/linux/man-pages/man1/bash.1.html#EXPANSION:~:text=%24%7Bparameter%40operator%7D

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Bug]: quoted argument wrongly splitted
3 participants