Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding handling for inner single quotes within shell_transforms #674

Open
JacobBas-Coalitioninc opened this issue Apr 4, 2022 · 1 comment
Projects

Comments

@JacobBas-Coalitioninc
Copy link

Hi, thanks for all of the work that you've put into this project!

When attempting to run a shell_transform with a python script I have a complex json string that includes inner single quotes that are not escaped out of.

For example, if I have the following json request:

{"flag_exists": "it doesn't"}

I'm met with the following error when running on a UNIX machine:

Error: Command failed: python3 /path/to/script.py '{"flag_exists": "it doesn't"}' 'other'

This is even shown in the code highlighting above. It looks like the tests are already sort of aware of this: https://github.com/bbyars/mountebank/blob/master/test/models/behaviors/shellTransformTest.js#L47-L52

I believe that the place that this needs to be fixed is given below where if you add something along the lines of the below chunk it would fix the issue:

`'${json.replace(/'/g, '\'')}'`; 

https://stackoverflow.com/questions/1250079/how-to-escape-single-quotes-within-single-quoted-strings#:~:text=I%20can%20confirm%20that%20using,quotes%20here%20are%20single%20quotes).

function quoteForShell (obj) {
const json = JSON.stringify(obj),
isWindows = require('os').platform().indexOf('win') === 0;
if (isWindows) {
// Confused? Me too. All other approaches I tried were spectacular failures
// in both 1) keeping the JSON as a single CLI arg, and 2) maintaining the inner quotes
return `"${json.replace(/"/g, '\\"')}"`;
}
else {
return `'${json}'`;
}
}

@bbyars bbyars added this to v2.8.0 in Roadmap Aug 13, 2022
@symonk
Copy link

symonk commented Apr 25, 2023

same problem on unix; data inclusive of single quoted strings aren't correctly escaped for the shell resulting in something along the lines of: {"foo": "'<bar>'"} trying to redirect to a file breaking the shell transform delegation to a python script for example

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Roadmap
v2.8.0
Development

No branches or pull requests

2 participants