[MSHARED-431] # (Hash-Sign) should trigger quoting in BourneShell.java

[jira-importer]

Fritz Elfert opened MSHARED-431 and commented

When trying to use the latest maven-jarsign-plugin using a keystore-password which started with a hash (#), signing failed. After enabling debug output with -X, I got a strange debug message:

[DEBUG] Option lacks argument

Since signtool is invoked using /bin/sh -c ..., of course, any # must be quoted, because otherwise it acts as a comment-start and thus effectively cuts-off the rest of the cmdline.
After single-quoting the password in the pom.xml, the jar signing was ok.

=>
Adding '#' to BASH_QUOTING_TRIGGER_CHARS in org.apache.maven.shared.utils.cli.shell.BourneShell.java should fix the problem.

---

Affects: maven-shared-utils-0.8

Issue Links:

• MSHARED-851 & must trigger quoting in Windows
  ("is cloned by")
• MSHARED-297 Commandline class shell injection vulnerabilities

0 votes, 6 watchers

[jira-importer]

Elliotte Rusty Harold commented

should be easy

[jira-importer]

Robert James Oxspring commented

Adding '#' to BASH_QUOTING_TRIGGER_CHARS is indeed fairly straight forward and can be demonstrated with a simple test.

Looking for the specifications of exactly what characters should be quoted I noticed this suggesting that '\\', '\"', '\'', '\t', '\n', '˜', '=', '%' ought to also be added. Any opinions out there as to whether we should be adding the entire list vs purposely omitting some/all of these additions?

[jira-importer]

Fritz Elfert commented

WOW. Finally almost 5 years after I reported this someone cares to look at it. Well, IMHO the whole CONDITIONAL quoting is a waste of time. Instead, just quote it ALWAYS using single quotes and you are on the safe side. This would solve MSHARED-297 as well. Of course, quotes inside quotes have to be escaped.

[jira-importer]

Dennis Lundberg commented

Can this issue be closed now?

[jira-importer]

Sylwester Lachiewicz commented

Done in 76605ac236ee5fb64062581209e8ee941efcea77