rush
rush copied to clipboard
Escaping of Environment Variables makes comprehensive escaping harder
Hi,
the escaping of passed environment variables applies additional escaping to " and `:
https://github.com/adamwiggins/rush/blob/master/lib/rush/box.rb#L85
E.g. if you escape ` and $ already in advance, an additional escaping will be applied to `, resulting in \\`, which does not escape ` but \. This can result in unintentionally executed commands surrounded by ` which were already escaped and thus assumed to be safe.
The repository seems large inactive, I still wanted to leave this issue in case it is helpful for someone.
Thanks, Matthias