10000 [Console] Fix escaping of args · symfony/symfony@8642b67 · GitHub
[go: up one dir, main page]
Skip to content

Commit 8642b67

Browse files
SeldaekSeldaek
committed
[Console] Fix escaping of args
1 parent 659eb66 commit 8642b67

File tree

6 files changed

+23
-16
lines changed

6 files changed

+23
-16
lines changed

‎src/Symfony/Component/Console/Input/ArgvInput.php

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -321,9 +321,10 @@ public function getParameterOption($values, $default = false)
321321
public function __toString()
322322
{
323323
$tokens = array_map(function ($token) {
324-
$token = addcslashes($token, '"');
325-
if (false !== strpos($token, ' ')) {
326-
return '"'.$token.'"';
324+
if (preg_match('{^(-[^=]+=)(.+)}', $token, $match)) {
325+
return $match[1] . $this->escapeToken($match[2]);
326+
} elseif ($token && $token[0] !== '-') {
327+
return $this->escapeToken($token);
327328
}
328329

329330
return $token;

‎src/Symfony/Component/Console/Input/ArrayInput.php

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -119,14 +119,10 @@ public function __toString()
119119
{
120120
$params = array();
121121
foreach ($this->parameters as $param => $val) {
122-
$val = addcslashes($val, '"');
123-
if (false !== strpos($val, ' ')) {
124-
$val = '"'.$val.'"';
125-
}
126122
if ($param && '-' === $param[0]) {
127-
$params[] = $param . ('' != $val ? ' '.$val : $val);
123+
$params[] = $param . ('' != $val ? '='.$this->escapeToken($val) : '');
128124
} else {
129-
$params[] = $val;
125+
$params[] = $this->escapeToken($val);
130126
}
131127
}
132128

‎src/Symfony/Component/Console/Input/Input.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -210,4 +210,14 @@ public function hasOption($name)
210210
{
211211
return $this->definition->hasOption($name);
212212
}
213+
214+
/**
215+
* Escapes a token through escapeshellarg if it contains unsafe chars
216+
*
217+
* @return string
218+
*/
219+
protected function escapeToken($token)
220+
{
221+
return preg_match('{^[\w-]+$}', $token) ? $token : escapeshellarg($token);
222+
}
213223
}

‎src/Symfony/Component/Console/Tests/Input/ArgvInputTest.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -260,8 +260,8 @@ public function testToString()
260260
$input = new ArgvInput(array('cli.php', '-f', 'foo'));
261261
$this->assertEquals('-f foo', (string) $input);
262262

263-
$input = new ArgvInput(array('cli.php', '-f', '--bar=foo', 'a b c d'));
264-
$this->assertEquals('-f --bar=foo "a b c d"', (string) $input);
263+
$input = new ArgvInput(array('cli.php', '-f', '--bar=foo', 'a b c d', "A\nB'C"));
264+
$this->assertEquals('-f --bar=foo '.escapeshellarg('a b c d').' '.escapeshellarg("A\nB'C"), (string) $input);
265265
}
266266

267267
/**

‎src/Symfony/Component/Console/Tests/Input/ArrayInputTest.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ public function provideInvalidInput()
123123

124124
public function testToString()
125125
{
126-
$input = new ArrayInput(array('-f' => null, '-b' => 'bar', '--foo' => 'b a z', '--lala' => null, 'test' => 'Foo'));
127-
$this->assertEquals('-f -b bar --foo "b a z" --lala Foo', (string) $input);
126+
$input = new ArrayInput(array('-f' => null, '-b' => 'bar', '--foo' => 'b a z', '--lala' => null, 'test' => 'Foo', 'test2' => "A\nB'C"));
127+
$this->assertEquals('-f -b=bar --foo='.escapeshellarg('b a z').' --lala Foo '.escapeshellarg("A\nB'C"), (string) $input);
128128
}
129129
}

‎src/Symfony/Component/Console/Tests/Input/StringInputTest.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -80,9 +80,9 @@ public function testToString()
8080
$this->assertEquals('-f foo', (string) $input);
8181

8282
$input = new StringInput('-f --bar=foo "a b c d"');
83-
$this->assertEquals('-f --bar=foo "a b c d"', (string) $input);
83+
$this->assertEquals('-f --bar=foo '.escapeshellarg('a b c d'), (string) $input);
8484

85-
$input = new StringInput('-f --bar=foo \'a b c d\'');
86-
$this->assertEquals('-f --bar=foo "a b c d"', (string) $input);
85+
$input = new StringInput('-f --bar=foo \'a b c d\' '."'A\nB\\'C'");
86+
$this->assertEquals('-f --bar=foo '.escapeshellarg('a b c d').' '.escapeshellarg("A\nB'C"), (string) $input);
8787
}
8888
}

0 commit comments

Comments
 (0)
0