Escape all shell arguments uniformly

zimbatm 28fa4a2f 852e9c30

Changed files
+20 -19
lib
nixos
modules
security
services
mail
misc
taskserver
networking
pkgs
build-support
vm
windows
controller
development
ruby-modules
bundler-env
gem
servers
x11
xquartz
+10 -1
lib/strings.nix
···
escapeShellArg "so([<>])me"
=> "so\\(\\[\\<\\>\\]\\)me"
*/
-
escapeShellArg = lib.escape (stringToCharacters "\\ ';$`()|<>\t*[]");
/* Obsolete - use replaceStrings instead. */
replaceChars = builtins.replaceStrings or (
···
escapeShellArg "so([<>])me"
=> "so\\(\\[\\<\\>\\]\\)me"
*/
+
escapeShellArg = arg:
+
lib.escape (stringToCharacters "\\ ';$`()|<>\t*[]") (toString arg);
+
+
/* Escape all arguments to be passed to the Bourne shell.
+
+
Example:
+
escapeShellArgs ["one" "two three"]
+
=> "one two\\ three"
+
*/
+
escapeShellArgs = concatMapStringsSep " " escapeShellArg;
/* Obsolete - use replaceStrings instead. */
replaceChars = builtins.replaceStrings or (
+1 -1
nixos/modules/security/acme.nix
···
script = ''
cd '${cpath}'
set +e
-
simp_le ${concatMapStringsSep " " (arg: escapeShellArg (toString arg)) cmdline}
EXITCODE=$?
set -e
echo "$EXITCODE" > /tmp/lastExitCode
···
script = ''
cd '${cpath}'
set +e
+
simp_le ${escapeShellArgs cmdline}
EXITCODE=$?
set -e
echo "$EXITCODE" > /tmp/lastExitCode
+1 -1
nixos/modules/services/mail/opendkim.nix
···
wantedBy = [ "multi-user.target" ];
serviceConfig = {
-
ExecStart = "${pkgs.opendkim}/bin/opendkim ${concatMapStringsSep " " escapeShellArg args}";
User = cfg.user;
Group = cfg.group;
RuntimeDirectory = optional (cfg.socket == defaultSock) "opendkim";
···
wantedBy = [ "multi-user.target" ];
serviceConfig = {
+
ExecStart = "${pkgs.opendkim}/bin/opendkim ${escapeShellArgs args}";
User = cfg.user;
Group = cfg.group;
RuntimeDirectory = optional (cfg.socket == defaultSock) "opendkim";
-2
nixos/modules/services/misc/taskserver/default.nix
···
};
};
-
mkShellStr = val: "'${replaceStrings ["'"] ["'\\''"] val}'";
-
certtool = "${pkgs.gnutls.bin}/bin/certtool";
nixos-taskserver = pkgs.buildPythonPackage {
···
};
};
certtool = "${pkgs.gnutls.bin}/bin/certtool";
nixos-taskserver = pkgs.buildPythonPackage {
+1 -1
nixos/modules/services/networking/ejabberd.nix
···
ectl = ''${cfg.package}/bin/ejabberdctl ${if cfg.configFile == null then "" else "--config ${cfg.configFile}"} --ctl-config "${ctlcfg}" --spool "${cfg.spoolDir}" --logs "${cfg.logsDir}"'';
-
dumps = lib.concatMapStringsSep " " lib.escapeShellArg cfg.loadDumps;
in {
···
ectl = ''${cfg.package}/bin/ejabberdctl ${if cfg.configFile == null then "" else "--config ${cfg.configFile}"} --ctl-config "${ctlcfg}" --spool "${cfg.spoolDir}" --logs "${cfg.logsDir}"'';
+
dumps = lib.escapeShellArgs cfg.loadDumps;
in {
+1 -3
pkgs/build-support/vm/windows/controller/default.nix
···
};
};
-
shellEscape = x: "'${replaceChars ["'"] [("'\\'" + "'")] x}'";
-
loopForever = "while :; do ${coreutils}/bin/sleep 1; done";
initScript = writeScript "init.sh" (''
···
-o StrictHostKeyChecking=no \
-i /ssh.key \
-l Administrator \
-
192.168.0.1 -- ${shellEscape command}
'') + optionalString (suspendTo != null) ''
${coreutils}/bin/touch /xchg/suspend_now
${loopForever}
···
};
};
loopForever = "while :; do ${coreutils}/bin/sleep 1; done";
initScript = writeScript "init.sh" (''
···
-o StrictHostKeyChecking=no \
-i /ssh.key \
-l Administrator \
+
192.168.0.1 -- ${lib.escapeShellArg command}
'') + optionalString (suspendTo != null) ''
${coreutils}/bin/touch /xchg/suspend_now
${loopForever}
+2 -4
pkgs/development/ruby-modules/bundler-env/default.nix
···
}@args:
let
-
-
shellEscape = x: "'${lib.replaceChars ["'"] [("'\\'" + "'")] x}'";
importedGemset = import gemset;
filteredGemset = (lib.filterAttrs (name: attrs:
if (builtins.hasAttr "groups" attrs)
···
"${confFiles}/Gemfile" \
"$out/${ruby.gemPath}" \
"${bundler}/${ruby.gemPath}" \
-
${shellEscape (toString envPaths)} \
-
${shellEscape (toString groups)}
'' + lib.optionalString (postBuild != null) postBuild;
passthru = rec {
inherit ruby bundler meta gems;
···
}@args:
let
importedGemset = import gemset;
filteredGemset = (lib.filterAttrs (name: attrs:
if (builtins.hasAttr "groups" attrs)
···
"${confFiles}/Gemfile" \
"$out/${ruby.gemPath}" \
"${bundler}/${ruby.gemPath}" \
+
${lib.escapeShellArg envPaths} \
+
${lib.escapeShellArg groups}
'' + lib.optionalString (postBuild != null) postBuild;
passthru = rec {
inherit ruby bundler meta gems;
+3 -4
pkgs/development/ruby-modules/gem/default.nix
···
# Normal gem packages can be used outside of bundler; a binstub is created in
# $out/bin.
-
{ lib, ruby, bundler, fetchurl, fetchgit, makeWrapper, git,
-
buildRubyGem, darwin
} @ defs:
lib.makeOverridable (
···
, ...} @ attrs:
let
-
shellEscape = x: "'${lib.replaceChars ["'"] [("'\\'" + "'")] x}'";
src = attrs.src or (
if type == "gem" then
fetchurl {
···
${src} \
${attrs.rev} \
${version} \
-
${shellEscape (toString buildFlags)}
''}
${lib.optionalString (type == "gem") ''
···
# Normal gem packages can be used outside of bundler; a binstub is created in
# $out/bin.
+
{ lib, fetchurl, fetchgit, makeWrapper, git, darwin
+
, ruby, bundler
} @ defs:
lib.makeOverridable (
···
, ...} @ attrs:
let
src = attrs.src or (
if type == "gem" then
fetchurl {
···
${src} \
${attrs.rev} \
${version} \
+
${lib.escapeShellArgs buildFlags}
''}
${lib.optionalString (type == "gem") ''
+1 -2
pkgs/servers/x11/xquartz/default.nix
···
# that point into the user's profile.
let
-
shellEscape = x: "'${lib.replaceChars ["'"] [("'\\'" + "'")] x}'";
installer = writeScript "xquartz-install" ''
NIX_LINK=$HOME/.nix-profile
···
defaultStartX="$out/bin/startx -- $out/bin/Xquartz"
ruby ${./patch_plist.rb} \
-
${shellEscape (builtins.toXML {
XQUARTZ_DEFAULT_CLIENT = "${xterm}/bin/xterm";
XQUARTZ_DEFAULT_SHELL = "${shell}";
XQUARTZ_DEFAULT_STARTX = "@STARTX@";
···
# that point into the user's profile.
let
installer = writeScript "xquartz-install" ''
NIX_LINK=$HOME/.nix-profile
···
defaultStartX="$out/bin/startx -- $out/bin/Xquartz"
ruby ${./patch_plist.rb} \
+
${lib.escapeShellArg (builtins.toXML {
XQUARTZ_DEFAULT_CLIENT = "${xterm}/bin/xterm";
XQUARTZ_DEFAULT_SHELL = "${shell}";
XQUARTZ_DEFAULT_STARTX = "@STARTX@";