search

sfackler / shell-escape

Apache License 2.0
20 stars 6 forks source link

Missing several shell metacharacters #1

Closed joshtriplett closed 7 years ago

joshtriplett commented 7 years ago

The UNIX implementation only escapes the following characters:

const SHELL_SPECIAL: &'static str = r#" \$'"`!"#;

It should escape at least the following characters (and possibly others):

const SHELL_SPECIAL: &'static str = "|&;<>()$`\\\"' \t\n*?[#~=%!{}";
sfackler commented 7 years ago

cc @alexcrichton

sfackler commented 7 years ago

According to this stack overflow post, the best approach might actually be to have a simple whitelist and then single-quote the contents since all that then needs to be escaped are single quotes: http://stackoverflow.com/a/20053121

joshtriplett commented 7 years ago

@sfackler Probably safer, and definitely more maintainable, yes.