gregwebs / Shelly.hs

Haskell shell scripting
BSD 3-Clause "New" or "Revised" License
418 stars 88 forks source link

escape all ssh arguments #159

Closed gregwebs closed 6 years ago

gregwebs commented 6 years ago

@qwfy what do you think about how this PR has 2 different escaping options?

qwfy commented 6 years ago

@gregwebs

what do you think about how this PR has 2 different escaping options?

You mean adding a new option, something like escapingOnRemote :: Bool?

I think:

  1. It won't cover all cases. Consider the following cases, I doubt that one new option will cover all these:
  1. But it's a good compramise, if, it can be implemented correctly:

    Implementing escapingOnRemote = True is easy: quote everything with signle quotes and you are covered.
    However, implementing escapingOnRemote = False is tricky, because every shell has different escaping rules, and it cannot even be done trivially just for the POSIX one, (see 2.2 Quoting).

The best I can think of is that, we expose some primitive functions, (like Shelly.quoteOne), and let the user compose the remote command string themselves, and we promise that the string will not be interpreted by the local shell, it's far far away from perfect though.

gregwebs commented 6 years ago

This PR tried to do remote escaping behavior based on the existing escaping setting. But I can see how that could easily cause more problems.

Doing no escaping and giving the user some quoting functions is definitely a good approach for extensibility.