ssh -t exec path concatenates the command unquoted — GNU-style -c shells lose all but the first word
评估
调研方向
The bug is in the pty branch of contrib/win32/win32compat/w32-doexec.c, where the command is concatenated unquoted after the shell's -c. Study the non-pty branch just below it and how build_exec_command escapes quotes/backslashes, then mirror that escaping in the pty path. Repro with a Git Bash DefaultShell and ssh -tt host 'sleep 30'; done means multi-word commands run identically with and without -t, including commands containing embedded quotes.
由索引模型根据 Issue 内容生成。
描述
"OpenSSH for Windows" version: 9.5p1 (in-box Optional Feature)
Server / Client OS: Windows 10 19045
What is failing
When a pty is allocated (ssh -t), do_exec_windows builds the shell
command line by plain concatenation in contrib/win32/win32compat/w32-doexec.c:
// pty path
strcpy_s(pty_cmd, len, shell); // "\"<shell path>\""
strcat_s(pty_cmd, len, " ");
strcat_s(pty_cmd, len, shell_command_option_local); // "-c"
strcat_s(pty_cmd, len, " ");
strcat_s(pty_cmd, len, command); // NOT quoted
This produces "C:\shell.exe" -c echo a b. Any shell whose -c takes a
single operand (GNU semantics — bash, and other bash-compatible shells)
then runs echo with a b demoted to $0/$1: the command silently
truncates to its first word.
The non-pty path immediately below does quote:
sprintf_s(posix_cmd_input, len, "%s %s \"%s\"", shell, option, exec_command);
Repro
Set a GNU-style shell as DefaultShell (e.g. Git Bash bash.exe or
Niubash niu.exe) with DefaultShellCommandOption = -c, then:
ssh -tt host 'whoami' → works (single word)
ssh -tt host 'sleep 30' → "sleep: missing operand" (30 lost)
ssh -tt host 'printf ok123' → "printf: usage: ..." (ok123 lost)
ssh -tt host 'echo x > f.txt' → bare echo; redirect never reaches the shell
ssh -tt host 'cmd /c echo x' → an interactive cmd prompt (args dropped)
The same commands work fine without -t, confirming the quoting
discrepancy between the two branches. cmd.exe and powershell.exe are not
affected because their /c/-c consume the rest of the command line —
which is presumably why this has gone unnoticed.
Expected
ssh -tt host 'sleep 30' runs sleep 30, same as without a pty.
Suggested fix
Quote the command operand in the pty branch (with proper
CommandLineToArgvW escaping for embedded quotes/backslashes), e.g.
append "%s" — noting that merely wrapping in quotes is not sufficient
for commands that already contain quotes; the escaping rules used by
build_exec_command/the non-pty path should be mirrored.
- 主要语言
- 没有语言数据
- 星标
- 8.3k
- 派生
- 822
- 平均合并
- 3 天 2 小时
- 30 天内合并 PR
- 2
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
PowerShell/Win32-OpenSSH 的其他 Issue
-
Area-ssh-agent Issue-Upstream Parity
难度 2/5 1-3 小时 新手友好度 74/100
PowerShell/Win32-OpenSSH#2458 · 1 条评论 · 1 个 reaction ·
-
难度 4/5 3-5 天 新手友好度 42/100
PowerShell/Win32-OpenSSH#2476 · 1 个 reaction ·
-
10.4.0.0p1-Preview: SSH sessions no longer get the user's PATH (HKCU\Environment), only the machine PATH可能已有人在做 @tgauth 于 5 天前认领。 未关闭
难度 3/5 1-2 天 新手友好度 57/100
PowerShell/Win32-OpenSSH#2474 · 3 条评论 · 1 个 reaction ·
-
难度 4/5 3-5 天 新手友好度 48/100
PowerShell/Win32-OpenSSH#2472 · 1 条评论 · 1 个 reaction ·
-
0 - Backlog Area-sshd Area-Terminal Investigate Issue-Bug
难度 4/5 3-5 天 新手友好度 48/100
PowerShell/Win32-OpenSSH#2468 · 17 条评论 · 1 个 reaction ·
查看 PowerShell/Win32-OpenSSH 的全部 Issue
相似的 Issue
-
bug
难度 2/5 1-3 小时 新手友好度 70/100
-
难度 2/5 1-3 小时 新手友好度 72/100
dsx-ai-factory/infra-controller#8341 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
btclib-org/btclib-wallet#587 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 82/100
Automattic/blocks-engine#3618 ·
维护者通常 1 天内回复
-
ai-generated
难度 2/5 1-3 小时 新手友好度 77/100
维护者通常 1 天内回复