From a4c7e73e12157957e12a3f70b42e173b97374eec Mon Sep 17 00:00:00 2001 From: Shulhan Date: Sat, 4 Sep 2021 00:30:41 +0700 Subject: os/exec: fix escaped quote inside the same quote Shell quote is a hell of complex. For example, one can write shell that execute command that contains quote, sh -c "psql -c 'CREATE ... IDENTIFIED BY PASSWORD '\''pass'\'''" or to simplify, sh -c "psql -c \"CREATE ... IDENTIFIED BY PASSWORD 'pass'\"" --- lib/os/exec/exec.go | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) (limited to 'lib/os/exec/exec.go') diff --git a/lib/os/exec/exec.go b/lib/os/exec/exec.go index 0fed245c..1f6f52cf 100644 --- a/lib/os/exec/exec.go +++ b/lib/os/exec/exec.go @@ -32,17 +32,31 @@ func ParseCommandArgs(in string) (cmd string, args []string) { for _, r := range in { if quote > 0 { if r == quote { - arg := sb.String() - if len(arg) > 0 { - cmdArgs = append(cmdArgs, sb.String()) + if prev == '\\' { + sb.WriteRune(r) + prev = r + } else { + arg := sb.String() + if len(arg) > 0 { + cmdArgs = append(cmdArgs, sb.String()) + } + sb.Reset() + quote = 0 + } + } else if r == '\\' { + if prev == '\\' { + sb.WriteRune(r) + prev = 0 + } else { + prev = r } - - sb.Reset() - quote = 0 } else { + if prev == '\\' { + sb.WriteRune('\\') + } sb.WriteRune(r) + prev = r } - prev = r continue } if r == '\'' || r == '"' || r == '`' { -- cgit v1.3-5-g45d5