Bug #14429: Overzealous escaping of + in Shellwords

• Status: Closed
• Assignee: knu (Akinori MUSHA)
• Target version: -
• ruby -v: ruby 2.4.3p205 (2017-12-14 revision 61247) [x86_64-linux-gnu]
• Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN

[woodruffw (William Woodruff)]

The Shellwords module is currently a little too conservative: + isn't a token in Bourne sh1, but Shellwords escapes it anyways.

Actual:

>> Shellwords.escape 'foo+bar' #=> "foo\\+bar"

Expected:

>> Shellwords.escape 'foo+bar' #=> "foo+bar"

I'm reporting this on ruby 2.4.3, but it looks like ruby-trunk is also affected2.

[woodruffw (William Woodruff)]

Ping (and confirming that this is still the case on 2.5.1p57).

[jeremyevans0 (Jeremy Evans)]

• File shellwords-plus.patch shellwords-plus.patch added
• Status changed from Open to Assigned
• Assignee set to knu (Akinori MUSHA)

While the current code is not really a bug (Shellwords.escape does not guarantee to only escape when required), I agree it makes sense not to escape +. From what I read, in addition to Bourne sh, neither bash nor ksh require escaping +. Attached is a patch that removes the escaping.

• Status changed from Assigned to Closed

Applied in changeset git|43a16c98df392e726040f0331a3e09d00c53d513.

---

Do not escape + in Shellwords.escape

• is not a character that requires escaping in Bourne sh.

Fixes [Bug #14429]