Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tasks.*.run templates: add shell escaping for arg() and option() #2906

Open
powerman opened this issue Nov 4, 2024 · 2 comments
Open

tasks.*.run templates: add shell escaping for arg() and option() #2906

powerman opened this issue Nov 4, 2024 · 2 comments
Labels
enhancement New feature or request

Comments

@powerman
Copy link
Contributor

powerman commented Nov 4, 2024

In v2024.11.0 both arg() and option() returns their values as is. As their values are supposed to be used in a shell command's param they needs to be escaped (using rules depending on current tasks.*.shell value).

Partial workaround is to surround them in a single quotes (e.g. '{{ arg(name="a") }}') - but this way we won't be able to use single quote itself in values.

Another but related issue: arg(var=true) and option(var=true) currently join list of their values using single space and this makes it impossible to correctly split it back to a list of values (which can itself contain spaces, quotes, shell wildcards, etc.). As a result currently it can be used only for list of values which does not contain any spaces/quotes/shell wildcards/etc.

@powerman powerman added the enhancement New feature or request label Nov 4, 2024
@jdx
Copy link
Owner

jdx commented Nov 4, 2024

As their values are supposed to be used in a shell command's param

not always, imagine this:

[tasks.run]
run = """
node <<EOF
console.log('{{arg(name="a")}}');
EOF
"""

I think it would be a mistake to blindly escape everything. We could add an escape=true option though.

@powerman
Copy link
Contributor Author

powerman commented Nov 4, 2024

Sure, sometimes you may need unescaped value. But if we had to choose between "always escaped" or "always unescaped" - then it's first! 😄

Probably escaping can be done using filter function in templates. This way you can control which arg/option to unescape. Just please-please-please make escaping default behaviour, so that extra filter will mark value as "raw, don't escape it".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants