tomerfiliba / plumbum / 27569602789 / 1

88%

master: 88%

push

github

fix: quote paths, cwd, env names in remote shell command lines (#820) (#821)

Several remote shell code paths interpolated untrusted strings (paths,
cwd, env-var names, glob directories) into command lines without quoting,
causing breakage on names with spaces and shell injection.

- remote.py expanduser: only the leading ~/~user prefix is expanded via a
  safe `echo ~user`; the remainder is treated as a literal string and never
  passed through the shell, so `~/a b; rm -rf c` no longer executes rm.
- ssh_machine.py / paramiko_machine.py popen: shquote the cwd in `cd ...`
  and validate env-var names against `[A-Za-z_][A-Za-z0-9_]*`, raising
  ValueError on unsafe names; also quote daemonic_popen redirect targets.
- remote.py RemoteEnv: validate variable names in __setitem__/__delitem__/
  pop/update before building export/unset commands.
- remote.py _path_glob: the non-recursive branch now uses `find` + a Python
  regex matcher with shquote (like the recursive branch), dropping the
  `echo $fn` word-splitting and space-only escaping.

Assisted-by: ClaudeCode:claude-opus-4.8

966 of 1764 branches covered (54.76%)

4420 of 6260 relevant lines covered (70.61%)

0.71 hits per line