Function TestShellQuote

easyssh_test.go:674–693

TestShellQuote pins the contract of the helper used to defend the SCP code path against remote command injection. If any of these cases regress, an attacker-controlled target path could execute arbitrary commands on the remote host.

(t *testing.T)

// attacker-controlled target path could execute arbitrary commands on the
// remote host.
func TestShellQuote(t *testing.T) {
	cases := []struct {
		in, want string
	}{
		{"", "''"},
		{"foo", "'foo'"},
		{"foo bar", "'foo bar'"},
		{"foo/bar.txt", "'foo/bar.txt'"},
		{"foo'bar", `'foo'\''bar'`},
		{"'", `''\'''`},
		{"$(rm -rf /)", "'$(rm -rf /)'"},
		{"`id`", "'`id`'"},
		{"a;b|c&d", "'a;b|c&d'"},
		{`"quoted"`, `'"quoted"'`},
	}
	for _, c := range cases {
		got := shellQuote(c.in)
		assert.Equal(t, c.want, got, "shellQuote(%q)", c.in)
	}
}

// TestWriteFileRejectsInvalidTargetName guards the SCP protocol-injection
// fix: a target filename containing newline/CR/NUL must be rejected before