-
-
Notifications
You must be signed in to change notification settings - Fork 590
Description
Information
- OS: Linux, Ubuntu 18.04 LTS
- Version: 0.44
- Terminal: xterm-256color, zsh
Describe the bug
Parameter values cannot start with double quotes ("
), they are either replaced or handled completely wrong. Additionally, parameter values are TRIMMED (remove leading spaces), so adding a space to workaround this is not possible.
The following example even cuts off the parameter value and treats everything after the space as EXTRA argument, in the following case value
is handled as positional argument and not part of --order-by
:
cli-tester test --order-by '"quoted" value' input.mp3
This may be a security flaw under specific circumstances.
More examples of invalid handling:
# `quoted` instead of `"quoted" value` and cut off handling as positional argument
cli-tester test --order-by '"quoted" value' input.mp3
cli-tester test --order-by='"quoted" value' input.mp3
# `quoted` instead of `"quoted"`
cli-tester test --order-by '"quoted"' input.mp3
# `quoted` instead of ` "quoted"`
cli-tester test --order-by ' "quoted"' input.mp3
The following examples work like expected, if not starting with double quotes or single quotes are used
# `value "quoted" like expected
cli-tester test --order-by 'value "quoted"' input.mp3
# `'quoted' value` like expected
cli-tester test --order-by "'quoted' value" input.mp3
# `\"quoted" value' value` like expected
cli-tester test --order-by='\"quoted" value' input.mp3
To Reproduce
- Compile https://github.com/sandreas/tone/tree/main/cli-tester
- Run the above examples
Expected behavior
I would expect double quotes ("
) and spaces (
) CAN be a valid part of a parameter value and should not be replaced or parsed out in any way.