rush icon indicating copy to clipboard operation
rush copied to clipboard

Escaping of Environment Variables makes comprehensive escaping harder

Open uchi-mata opened this issue 5 years ago • 0 comments

Hi,

the escaping of passed environment variables applies additional escaping to " and `: https://github.com/adamwiggins/rush/blob/master/lib/rush/box.rb#L85

E.g. if you escape ` and $ already in advance, an additional escaping will be applied to `, resulting in \\`, which does not escape ` but \. This can result in unintentionally executed commands surrounded by ` which were already escaped and thus assumed to be safe.

The repository seems large inactive, I still wanted to leave this issue in case it is helpful for someone.

Thanks, Matthias

uchi-mata avatar Jul 08 '20 12:07 uchi-mata