Escaped bash special characters for bash command - #2033
Conversation
Excapes '&' and similar characters in file names
kalisp
added
type: enhancement
iLLiCiTiT
left a comment
iLLiCiTiT
left a comment
There was a problem hiding this comment.
I can't test it but looks reasonable.
There was a problem hiding this comment.
🟡 Changes recommended
Context-free escaping corrupts quoted file paths and alters intentional shell syntax.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Attempts to support special characters in POSIX shell command arguments.
Changes:
- Escapes common shell metacharacters on non-Windows systems.
- Broadens handling beyond Bash and
shenvironment detection.
File summaries
| File | Description |
|---|---|
client/ayon_core/lib/execute.py |
Rewrites shell command strings to escape metacharacters. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| .replace("&", "\\&") | ||
| .replace(";", "\\;") | ||
| .replace("|", "\\|") | ||
| .replace("$", "\\$") | ||
| .replace(">", "\\>") |
There was a problem hiding this comment.
I was testing it on uploading video_v001_b&w.mp4 via Webpublisher service (which is running on Linux). Tray publisher on Linux/MacOS would do the trick too.
There was a problem hiding this comment.
We can't use shell=False if that's what you're asking for?
github-project-automation
Bot
moved this from Review In Progress
to Merge Requested
in PR reviewing
…in_filenames_linux
…in_filenames_linux
github-project-automation
Bot
moved this from Review In Progress
to Done
in PR reviewing
Changelog Description
This handles passing file paths (or any weird arguments) with special characters that are used in bash commands (as
&for example).Issue occurred in Webpublisher uploading file like
video_v001_b&w.mp4, but would happen also in Tray Publisher (on Linux/Macs).Additional info
This approach is based on sending whole command as a string and
shell=False. It recommended me to not do that, pass it as list, without that flag, but I think we had our reasons why we had it this way.It is a question, if this approach should be actually used as it might be too 'blanket-wide', as it would escape
&or '|' if they should be used as real bash special characters. But if we were already escaping parentheses, it might not be a valid worry.Testing notes:
video_v001_b&w.mp4via Weppublisher service (!) or Tray Publisher on Linux/MacExtractReview