Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Dotfiles install script interpolates targetPath/repository unquoted: paths with spaces break git clone/cd

未关闭
  • 哪里不对？
#1,283 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
78/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
shell, typescript
领域
cli

调研方向

从 src/spec-common/dotfiles.ts 中的 installDotfiles 开始并阅读 quoteValue，然后检查 devContainers.ts 中的 ResolverParameters，以了解 targetPath 的默认值。为包含空格的 targetPath 添加一个单元测试，并验证生成的安装脚本能够保留路径、处理默认的波浪号路径，并成功完成 dotfiles 安装。

由索引模型根据 Issue 内容生成。

描述

Summary

installDotfiles() interpolates ${targetPath} and ${repository} into a generated POSIX shell script without quoting, while environment-variable values in the very same script are escaped through quoteValue(). Any user-configured dotfiles path containing spaces (or other shell metacharacters) breaks the script via word splitting — git clone, [ -e ] and cd all operate on the wrong words — producing confusing failures during container start.

Location

  • File: src/spec-common/dotfiles.ts
  • Function: installDotfiles
  • Unquoted interpolations: lines 46, 48 ([ -e ${targetPath} ], git clone … ${targetPath}, cd ${targetPath}) and the same pattern at 77–79; also line 90 (ls -d ${targetPath}/.*)
  • Contrast: lines 33–35 + quoteValue() (124–126) deliberately single-quote-escape every environment value passed into the same script
// env values are quoted...
const allEnv = Object.keys(dockerEnvAndSecrets)
    .reduce((env, key) => `${env}${key}=${quoteValue(dockerEnvAndSecrets[key])} `, '');
...
await shellServer.exec(`# Clone & install dotfiles
...
[ -e ${targetPath} ] || ${allEnv}git clone --depth 1 ${repository} ${targetPath} || exit $?
echo Setting current directory to '${targetPath}'
cd ${targetPath}
...`);

Problem

targetPath is user-configurable (dotfiles.targetPath, see ResolverParameters in devContainers.ts; default '~/dotfiles') and flows verbatim into the script. For a value containing whitespace, e.g. /home/user/My Dotfiles, the generated lines become:

[ -e /home/user/My Dotfiles ] || git clone --depth 1 <repo> /home/user/My Dotfiles || exit $?
cd /home/user/My Dotfiles

which word-split into [ -e /home/user/My and Dotfiles ], a two-argument clone invocation with a stray Dotfiles argument, and a two-directory cd. The result is a failed or mis-cloned install with opaque shell errors rather than either success or a clear message. The same applies to repository if it contains characters interpreted by the shell.

Note that naive quoting cannot simply be added around ${targetPath} for the default value, because ~/dotfiles currently relies on unquoted tilde expansion — so the fix needs to handle tilde explicitly (e.g. expand to $HOME in TypeScript, or emit "${HOME}/dotfiles"), which is presumably why the current code avoids quotes.

Trigger / Reproduction

Static analysis finding — not confirmed by execution; derived from the template literals at main (33073dba):

// devcontainer.json / CLI option
"dotfiles": {
    "repository": "https://github.com/user/dotfiles.git",
    "targetPath": "/home/user/My Dotfiles"
}

Run devcontainer up with dotfile installation enabled → the generated script splits words at the space and the install fails mid-way.

Expected Behavior

Values interpolated into the shell script should be quoted/escaped consistently with how env values already are (quoteValue), with tilde handled explicitly so the default ~/dotfiles keeps working.

Actual Behavior

Unquoted expansion; paths with spaces (or glob/metacharacters) are split by the shell and every downstream command misbehaves.

Impact

Any non-trivial dotfiles.targetPath silently corrupts the install script. Because the surrounding code already goes to the trouble of safely quoting environment values, this looks like an oversight rather than a constraint, and it produces hard-to-diagnose failures during dev-container startup.

Suggested Direction

Emit TARGET_PATH/REPO as properly quoted assignments (reusing quoteValue), convert a leading ~/ to $HOME/ before quoting, and reference "$TARGET_PATH" throughout the script. A unit test exercising a targetPath with a space would prevent regressions.

主要语言
TypeScript
星标
3k
派生
463
平均合并
13 小时 28 分钟
30 天内合并 PR
2

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

devcontainers/cli 的其他 Issue

查看 devcontainers/cli 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。