Information
- OS: Linux, Ubuntu 18.04 LTS
- Version: 0.44
- Terminal: xterm-256color, zsh
Describe the bug
Parameter values cannot start with double quotes ("), they are either replaced or handled completely wrong. Additionally, parameter values are TRIMMED (remove leading spaces), so adding a space to workaround this is not possible.
The following example even cuts off the parameter value and treats everything after the space as EXTRA argument, in the following case value is handled as positional argument and not part of --order-by:
cli-tester test --order-by '"quoted" value' input.mp3
This may be a security flaw under specific circumstances.
More examples of invalid handling:
# `quoted` instead of `"quoted" value` and cut off handling as positional argument
cli-tester test --order-by '"quoted" value' input.mp3
cli-tester test --order-by='"quoted" value' input.mp3
# `quoted` instead of `"quoted"`
cli-tester test --order-by '"quoted"' input.mp3
# `quoted` instead of ` "quoted"`
cli-tester test --order-by ' "quoted"' input.mp3
The following examples work like expected, if not starting with double quotes or single quotes are used
# `value "quoted" like expected
cli-tester test --order-by 'value "quoted"' input.mp3
# `'quoted' value` like expected
cli-tester test --order-by "'quoted' value" input.mp3
# `\"quoted" value' value` like expected
cli-tester test --order-by='\"quoted" value' input.mp3
To Reproduce
Expected behavior
I would expect double quotes (") and spaces ( ) CAN be a valid part of a parameter value and should not be replaced or parsed out in any way.
Information
Describe the bug
Parameter values cannot start with double quotes (
"), they are either replaced or handled completely wrong. Additionally, parameter values are TRIMMED (remove leading spaces), so adding a space to workaround this is not possible.The following example even cuts off the parameter value and treats everything after the space as EXTRA argument, in the following case
valueis handled as positional argument and not part of--order-by:This may be a security flaw under specific circumstances.
More examples of invalid handling:
The following examples work like expected, if not starting with double quotes or single quotes are used
To Reproduce
Expected behavior
I would expect double quotes (
") and spaces () CAN be a valid part of a parameter value and should not be replaced or parsed out in any way.