tomerfiliba / plumbum

88%

LAST BUILD ON BRANCH master

branch: SELECT

CHANGE BRANCH

x

• No branch selected
• HEAD
• add-local-aliases
• all-repos_autofix_all-repos-sed
• all-repos_autofix_all-repos_autofix_all-repos-sed_setup-uv8.0.0
• appveyor
• async
• atexit
• better-process-execution-error
• cached-programs
• cli-autocompletes
• colorcleanup
• copilot/assign-subapp-to-multiple-names
• copilot/fix-broken-pipe-error
• copilot/fix-invoke-flag-behavior
• copilot/fix-quoting-inconsistency
• copilot/update-ci-to-ubuntu-24-04
• dependabot/github_actions/actions-3204d75334
• dependabot/github_actions/actions-64ad3b9038
• dependabot/github_actions/actions-69cd449f7d
• dependabot/github_actions/actions-76468cb07f
• dependabot/github_actions/actions-81661f83bb
• dependabot/github_actions/actions-a8d5d8ac85
• dependabot/github_actions/actions-b46a43034d
• dependabot/github_actions/actions-bf45d9ad10
• dependabot/github_actions/actions-d988a0d7e8
• dependabot/github_actions/actions-faf93ff285
• dev
• div0
• drop-unused-variables
• dropxfail
• encoding-resilient-iter-lines
• fix-36
• fix-816-switchinfo-unhashable
• fix-cli-Set-validator
• fix-cmd-with-env
• fix-read
• fix-ssh-hang
• fix-stdin-quadratic-copy
• fix-termsize-linux
• fix-tests-non-english
• fix/async-review-805
• fix/cli-parsing-bugs
• fix/colorlib-correctness
• fix/path-fs-correctness
• fix/pre-2.0-bugs
• fix/pre-2.0-cleanup
• fix/pre-2.0-typing
• fix/pre-2.0-worth-fixing
• fix/recursive-glob
• fix/remote-shell-quoting
• fix/subprocess-lifecycle
• fixing_ssh_windows
• fixtravis
• fixtravis26
• getitem
• glob_remote
• glob_with_space
• henryiii-override
• henryiii-patch-1
• henryiii-patch-2
• henryiii-patch-3
• henryiii-readme
• henryiii-travis
• henryiii-travis2
• henryiii-whitespace
• henryiii/chore/110
• henryiii/chore/claude
• henryiii/chore/condarec
• henryiii/chore/evenmoreslots
• henryiii/chore/fs
• henryiii/chore/lazy
• henryiii/chore/moreslots
• henryiii/chore/mypyup
• henryiii/chore/nox2025
• henryiii/chore/simplerjoin
• henryiii/chore/sprr
• henryiii/chore/tc
• henryiii/chore/tid
• henryiii/chore/typeexamp
• henryiii/chore/typing10
• henryiii/chore/typing11
• henryiii/chore/typing12
• henryiii/chore/typing13
• henryiii/chore/typing2
• henryiii/chore/typing3
• henryiii/chore/typing5
• henryiii/chore/typing6
• henryiii/chore/typing7
• henryiii/chore/typing8
• henryiii/chore/typing9
• henryiii/chore/typing_color
• henryiii/ci/lite
• henryiii/ci/py315
• henryiii/ci/pypy311
• henryiii/ci/scriptup
• henryiii/docs/20
• henryiii/docs/badge
• henryiii/docs/furo
• henryiii/docs/missing
• henryiii/docs/news
• henryiii/docs/reducewarn
• henryiii/feat/apipe
• henryiii/feat/apipe3
• henryiii/feat/colorstring
• henryiii/feat/dropcoloratexit
• henryiii/feat/morepathapi
• henryiii/feat/py314
• henryiii/fix/allanddir
• henryiii/fix/annotations
• henryiii/fix/asyncpipes
• henryiii/fix/cache
• henryiii/fix/docs
• henryiii/fix/hidedl
• henryiii/fix/moretype
• henryiii/fix/nocolor
• henryiii/fix/sdreg
• henryiii/fix/timer
• henryiii/fix/typesignore
• henryiii/fix/warn315
• henryiii/fix/warnings
• henryiii/tests-broken-pipe-error
• henryiii/tests/cov
• henryiii/tests/importerror
• henryiii/tests/supportpytest9
• local.cmd
• master
• more-cli-set-validator-tests
• more_examples
• multi-type-set-cli-switch
• mypy
• nohup-big-fixes
• non-setuptools
• path-resolve-bugfix
• path-subscription
• pathlib-like
• pipe-to-logger
• py37
• pyfix
• quicktransbug
• remove-pywin32-dependency
• revert-308-scrap-redundant-encoding
• source_support
• ssh-machine-errors
• threadsafe-shell-session
• travisfixes
• typed-env
• typed-env-docs
• uni
• utils
• v1.6.1
• v1.6.2
• v1.6.3
• v1.6.4
• v1.6.5
• v1.6.6
• v1.6.7
• v1.6.8
• v1.7.1
• v1.8.0
• win32-iter-lines
• win32-iter-lines-old

Build # 27569602789

Build Type

push

github

Committed by web-flow

Commit Message

fix: quote paths, cwd, env names in remote shell command lines (#820) (#821)

Several remote shell code paths interpolated untrusted strings (paths,
cwd, env-var names, glob directories) into command lines without quoting,
causing breakage on names with spaces and shell injection.

- remote.py expanduser: only the leading ~/~user prefix is expanded via a
  safe `echo ~user`; the remainder is treated as a literal string and never
  passed through the shell, so `~/a b; rm -rf c` no longer executes rm.
- ssh_machine.py / paramiko_machine.py popen: shquote the cwd in `cd ...`
  and validate env-var names against `[A-Za-z_][A-Za-z0-9_]*`, raising
  ValueError on unsafe names; also quote daemonic_popen redirect targets.
- remote.py RemoteEnv: validate variable names in __setitem__/__delitem__/
  pop/update before building export/unset commands.
- remote.py _path_glob: the non-recursive branch now uses `find` + a Python
  regex matcher with shquote (like the recursive branch), dropping the
  `echo $fn` word-splitting and space-only escaping.

Assisted-by: ClaudeCode:claude-opus-4.8

Coverage Stats

1327 of 1780 branches covered (74.55%)

29 of 29 new or added lines in 3 files covered. (100.0%)

5508 of 6291 relevant lines covered (87.55%)

12.4 hits per line