pressly / sup

Super simple deployment tool - think of it like 'make' for a network of servers
https://pressly.github.io/sup
MIT License
2.48k stars 176 forks source link

SUP_ENV needs escaping #154

Open untoreh opened 5 years ago

untoreh commented 5 years ago

SUP_ENV is not escaped:

sup -D -e HELLO="1 2 3" local env
fra@localhost | bash: line 0: export: `2': not a valid identifier
fra@localhost | bash: line 0: export: `3': not a valid identifier
fra@localhost | + echo SUP_ENV is '-e HELLO=1'
fra@localhost | SUP_ENV is -e HELLO=1
commands:
  env:
    desc: print env
    run: echo SUP_ENV is "$SUP_ENV"

this one does not break but the quoting is lost

sup -D -e HELLO="'""1 2 3""'" local env

this one does not break and preserves quoting

sup -D -e HELLO='"'"'1 2 3'"'"' local env
VojtechVitek commented 5 years ago

Sup sets the env var as a string value, it shouldn't need any additional escaping.

I think you need to escape the "$HELLO" variable in the remote shell.

$ export HELLO="1 2 3"

$ $HELLO
bash: 1: command not found

$ "$HELLO"
bash: 1 2 3: command not found

Please, feel free to reopen if this doesn't help.

untoreh commented 5 years ago

I don't think I understood what you meant. The point is that sup doesn't escape quotes in the SUP_ENV variable. And since sup (well the go ssh package since sup does not do any mods) executes the command as an argument (bash -c "export SUP....") it ends up like bash -c "...; export SUP_ENV="HELLO=" 1 2 3" OTHER_VAR=X"; ... " when it should be bash -c "...; export SUP_ENV="HELLO=\" 1 2 3\" OTHER_VAR=X"; ... " The user has no control over the SUP_ENV variable

VojtechVitek commented 5 years ago

I might have misunderstood then. Can you provide a reproducer Supfile?

untoreh commented 5 years ago

well there was already the command snippet just add a local network

# Supfile
version: 0.4
networks:
  local:
    hosts:
      - localhost
commands:
  env:
    desc: print env
    run: echo SUP_ENV is "$SUP_ENV"