Command containing quotes are now escaped.

shipitjs · Oct 8, 2014 · 24460b4 · 24460b4
1 parent bf128e0
commit 24460b4
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/lib/ssh/connection.js b/lib/ssh/connection.js
@@ -52,6 +52,9 @@ Connection.prototype.run = function (command, options, cb) {
   var args = /^sudo/.exec(command) ? ['-tt'] : [];
   args.push(remote.format(this.remote));
 
+  // Escape double quotes in command.
+  command = command.replace(/"/g, '\\"');
+
   // Complete arguments.
   args = ['ssh'].concat(args).concat(['"' + command + '"']);
 

diff --git a/test/unit/ssh/connection.js b/test/unit/ssh/connection.js
@@ -62,6 +62,15 @@ describe('SSH Connection', function () {
       );
     });
 
+    it('should escape double quotes', function (done) {
+      connection.run('echo "ok"', {cwd: '/root'}, done);
+
+      expect(childProcess.exec).to.be.calledWith(
+        'ssh user@host "echo \\"ok\\""',
+        { cwd: '/root', maxBuffer: 1000 * 1024 }
+      );
+    });
+
     it('should handle childProcess.exec callback correctly', function (done) {
       connection.run('my-command -x', { cwd: '/root' }, function(err, stdout, stderr) {
         if (err) return done(err);