Repository navigation
CmdShell does not escape asterisk arg value (SCM-763) #37
Description
Activity
@michael-o is this still an issue? I see SCM-763 is fixed now.
Yes, it is. The entire process execution suffers from one serious flaw that it executes a local shell rather than providing it to the system directory. The shell will do its own replacement which hasn't been espaced by this implementation.
Is it worth keeping the issue open? Any idea how this should be fixed?
Is it worth keeping the issue open? Any idea how this should be fixed?
Yes, because the shell invocation needs to be dropped altogether.
Should be fixed here or deprecated here CmdShell and fix it properly on SCM?
Should be fixed here or deprecated here CmdShell and fix it properly on SCM?
Completely here replace all shell impls with ProcessBuilder
- marked CmdShell does not escape double quote arg value (SCM-763) #36 as a duplicate of this issue
on Apr 17, 2025
This was found during SCM-763.
Consider your want to pass a password (on Windows) with asterisk:
S8p3r*S3cr3t. The escaped outcome isS8p3r*S3cr3t. No change, but to pass an asterisk you need to quote the entire string otherwise the shell will expand the asterisk. Correct value would be:"S8p3r*S3cr3t"Currently, this is impossible in Plexus Utils.