ljharb/shell-quote

Not expanding unquoted variables correctly

Open

#1 opened on Oct 21, 2022

View on GitHub
 (11 comments) (0 reactions) (0 assignees)JavaScript (19 forks)github user discovery
bugenhancementhelp wantedquestion

Repository metrics

Stars
 (53 stars)
PR merge metrics
 (PR metrics pending)

Description

Consider the following example:

$ export T="c d"
$ node -e 'console.log(JSON.stringify(process.env.T), process.argv)' a b $T

You get the following result:

"c d" [
  '/home/ec2-user/.nvm/versions/node/v17.0.1/bin/node',
  'a',
  'b',
  'c',
  'd'
]

The variable T is expanded in possitional args c and d. If we quote the variable then we get a different result:

$ export T="c d"
$ node -e 'console.log(JSON.stringify(process.env.T), process.argv)' a b "$T"
"c d" [
  '/home/ec2-user/.nvm/versions/node/v17.0.1/bin/node',
  'a',
  'b',
  'c d'
]

However, in the shell-quote library the situation is different. Consider the following example:

const shellQuote = require('shell-quote')

console.log(shellQuote.parse('test a b $T', { T: 'c d' }))

We get the following result:

[ 'test', 'a', 'b', 'c d' ]

Notice that the behaviour is different as in the variable T does not get expanded. In other words, the behaviour is similar to variable T beign quoted, i.e:

const shellQuote = require('shell-quote')

console.log(shellQuote.parse('test a b "$T"', { T: 'c d' })) // [ 'test', 'a', 'b', 'c d' ]

If shell-quote is used to parse string which are used to spown a process with environment variable that are not quoted, it will result in a completely different behaviour than the one expected from the standard shell.

Contributor guide