Skip to content

Not expanding unquoted variables correctly #1

@pdpwebsecurify

Description

@pdpwebsecurify

Consider the following example:

$ export T="c d"
$ node -e 'console.log(JSON.stringify(process.env.T), process.argv)' a b $T

You get the following result:

"c d" [
  '/home/ec2-user/.nvm/versions/node/v17.0.1/bin/node',
  'a',
  'b',
  'c',
  'd'
]

The variable T is expanded in possitional args c and d. If we quote the variable then we get a different result:

$ export T="c d"
$ node -e 'console.log(JSON.stringify(process.env.T), process.argv)' a b "$T"
"c d" [
  '/home/ec2-user/.nvm/versions/node/v17.0.1/bin/node',
  'a',
  'b',
  'c d'
]

However, in the shell-quote library the situation is different. Consider the following example:

const shellQuote = require('shell-quote')

console.log(shellQuote.parse('test a b $T', { T: 'c d' }))

We get the following result:

[ 'test', 'a', 'b', 'c d' ]

Notice that the behaviour is different as in the variable T does not get expanded. In other words, the behaviour is similar to variable T beign quoted, i.e:

const shellQuote = require('shell-quote')

console.log(shellQuote.parse('test a b "$T"', { T: 'c d' })) // [ 'test', 'a', 'b', 'c d' ]

If shell-quote is used to parse string which are used to spown a process with environment variable that are not quoted, it will result in a completely different behaviour than the one expected from the standard shell.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinghelp wantedExtra attention is needed

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions