tomerfiliba / plumbum / 27569602789 / 2

88%

master: 88%

push

github

fix: quote paths, cwd, env names in remote shell command lines (#820) (#821)

Several remote shell code paths interpolated untrusted strings (paths,
cwd, env-var names, glob directories) into command lines without quoting,
causing breakage on names with spaces and shell injection.

- remote.py expanduser: only the leading ~/~user prefix is expanded via a
  safe `echo ~user`; the remainder is treated as a literal string and never
  passed through the shell, so `~/a b; rm -rf c` no longer executes rm.
- ssh_machine.py / paramiko_machine.py popen: shquote the cwd in `cd ...`
  and validate env-var names against `[A-Za-z_][A-Za-z0-9_]*`, raising
  ValueError on unsafe names; also quote daemonic_popen redirect targets.
- remote.py RemoteEnv: validate variable names in __setitem__/__delitem__/
  pop/update before building export/unset commands.
- remote.py _path_glob: the non-recursive branch now uses `find` + a Python
  regex matcher with shquote (like the recursive branch), dropping the
  `echo $fn` word-splitting and space-only escaping.

Assisted-by: ClaudeCode:claude-opus-4.8

1283 of 1765 branches covered (72.69%)

5404 of 6283 relevant lines covered (86.01%)

0.86 hits per line