ljharb/shell-quote

Not expanding unquoted variables correctly

Open

#1 aperta il 21 ott 2022

Vedi su GitHub
 (11 commenti) (0 reazioni) (0 assegnatari)JavaScript (19 fork)github user discovery
bugenhancementhelp wantedquestion

Metriche repository

Star
 (53 star)
Metriche merge PR
 (Metriche PR in attesa)

Descrizione

Consider the following example:

$ export T="c d"
$ node -e 'console.log(JSON.stringify(process.env.T), process.argv)' a b $T

You get the following result:

"c d" [
  '/home/ec2-user/.nvm/versions/node/v17.0.1/bin/node',
  'a',
  'b',
  'c',
  'd'
]

The variable T is expanded in possitional args c and d. If we quote the variable then we get a different result:

$ export T="c d"
$ node -e 'console.log(JSON.stringify(process.env.T), process.argv)' a b "$T"
"c d" [
  '/home/ec2-user/.nvm/versions/node/v17.0.1/bin/node',
  'a',
  'b',
  'c d'
]

However, in the shell-quote library the situation is different. Consider the following example:

const shellQuote = require('shell-quote')

console.log(shellQuote.parse('test a b $T', { T: 'c d' }))

We get the following result:

[ 'test', 'a', 'b', 'c d' ]

Notice that the behaviour is different as in the variable T does not get expanded. In other words, the behaviour is similar to variable T beign quoted, i.e:

const shellQuote = require('shell-quote')

console.log(shellQuote.parse('test a b "$T"', { T: 'c d' })) // [ 'test', 'a', 'b', 'c d' ]

If shell-quote is used to parse string which are used to spown a process with environment variable that are not quoted, it will result in a completely different behaviour than the one expected from the standard shell.

Guida contributor