Hi,
the escaping of passed environment variables applies additional escaping to " and `:
https://github.com/adamwiggins/rush/blob/master/lib/rush/box.rb#L85
E.g. if you escape ` and $ already in advance, an additional escaping will be applied to `, resulting in \\`, which does not escape ` but \. This can result in unintentionally executed commands surrounded by ` which were already escaped and thus assumed to be safe.
The repository seems large inactive, I still wanted to leave this issue in case it is helpful for someone.
Thanks,
Matthias
Hi,
the escaping of passed environment variables applies additional escaping to
"and`:https://github.com/adamwiggins/rush/blob/master/lib/rush/box.rb#L85
E.g. if you escape
`and$already in advance, an additional escaping will be applied to`, resulting in\\`, which does not escape`but\. This can result in unintentionally executed commands surrounded by`which were already escaped and thus assumed to be safe.The repository seems large inactive, I still wanted to leave this issue in case it is helpful for someone.
Thanks,
Matthias