Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

ssh -t exec path concatenates the command unquoted — GNU-style -c shells lose all but the first word

Aperta
  • Qualcosa non va?
#2,478 0 commenti 1 reazione 0 assegnatari Vedi su GitHub

@caomengxuan666 ci sta già lavorando.

Dal 24/10/2026.

  • #889 di @caomengxuan666 — aperta

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
62/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
c
Ambito
backend

Direzione di ricerca

The bug is in the pty branch of contrib/win32/win32compat/w32-doexec.c, where the command is concatenated unquoted after the shell's -c. Study the non-pty branch just below it and how build_exec_command escapes quotes/backslashes, then mirror that escaping in the pty path. Repro with a Git Bash DefaultShell and ssh -tt host 'sleep 30'; done means multi-word commands run identically with and without -t, including commands containing embedded quotes.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

"OpenSSH for Windows" version: 9.5p1 (in-box Optional Feature)

Server / Client OS: Windows 10 19045

What is failing

When a pty is allocated (ssh -t), do_exec_windows builds the shell
command line by plain concatenation in contrib/win32/win32compat/w32-doexec.c:

// pty path
strcpy_s(pty_cmd, len, shell);                       // "\"<shell path>\""
strcat_s(pty_cmd, len, " ");
strcat_s(pty_cmd, len, shell_command_option_local);  // "-c"
strcat_s(pty_cmd, len, " ");
strcat_s(pty_cmd, len, command);                     // NOT quoted

This produces "C:\shell.exe" -c echo a b. Any shell whose -c takes a
single operand (GNU semantics — bash, and other bash-compatible shells)
then runs echo with a b demoted to $0/$1: the command silently
truncates to its first word.

The non-pty path immediately below does quote:

sprintf_s(posix_cmd_input, len, "%s %s \"%s\"", shell, option, exec_command);

Repro

Set a GNU-style shell as DefaultShell (e.g. Git Bash bash.exe or
Niubash niu.exe) with DefaultShellCommandOption = -c, then:

ssh -tt host 'whoami'          → works (single word)
ssh -tt host 'sleep 30'        → "sleep: missing operand"   (30 lost)
ssh -tt host 'printf ok123'    → "printf: usage: ..."       (ok123 lost)
ssh -tt host 'echo x > f.txt'  → bare echo; redirect never reaches the shell
ssh -tt host 'cmd /c echo x'   → an interactive cmd prompt  (args dropped)

The same commands work fine without -t, confirming the quoting
discrepancy between the two branches. cmd.exe and powershell.exe are not
affected because their /c/-c consume the rest of the command line —
which is presumably why this has gone unnoticed.

Expected

ssh -tt host 'sleep 30' runs sleep 30, same as without a pty.

Suggested fix

Quote the command operand in the pty branch (with proper
CommandLineToArgvW escaping for embedded quotes/backslashes), e.g.
append "%s" — noting that merely wrapping in quotes is not sufficient
for commands that already contain quotes; the escaping rules used by
build_exec_command/the non-pty path should be mirrored.

Lingua principale
Nessun dato sulla lingua
Stelle
8.3k
Fork
822
Merge medio
7m
PR unite (30g)
1

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di PowerShell/Win32-OpenSSH

Tutte le issue di PowerShell/Win32-OpenSSH

Issue simili

Altre issue su Backend & API Design

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.