Skip to content

Commit ad87b26

Browse files
committed
fix(cli): shell-safe single-quoting of generated --data examples
The cligen example help wrapped the spec's example JSON in single quotes (--data '<json>') without escaping embedded single quotes, so an example whose JSON contained a "'" produced a command that breaks out of the shell quoting when copy-pasted. This was live: the monit query-diagnose example carries a VictoriaLogs query `_stream:{status='500'}`, whose quotes split the argument in a real shell. Escape embedded single quotes as the standard '\'' sequence via a shellSingleQuote helper. The escaped example round-trips through bash back to valid JSON. Also clears the pre-existing go/unsafe-quoting CodeQL alert, which this PR's exampleHelp refactor had re-attributed to the diff.
1 parent 7564fae commit ad87b26

2 files changed

Lines changed: 10 additions & 2 deletions

File tree

internal/cli/zz_generated_diagnostics.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

internal/cmd/cligen/main.go

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1096,7 +1096,15 @@ func exampleHelp(o specOp) string {
10961096
if o.Example == "" {
10971097
return ""
10981098
}
1099-
return " flashduty " + cliGroup(o.Path) + " " + cliVerb(o.Path) + " --data '" + o.Example + "'"
1099+
return " flashduty " + cliGroup(o.Path) + " " + cliVerb(o.Path) + " --data " + shellSingleQuote(o.Example)
1100+
}
1101+
1102+
// shellSingleQuote wraps s in single quotes safe for a POSIX shell, escaping any
1103+
// embedded single quote as the standard '\” sequence so a copy-pasted --data
1104+
// example never breaks out of the quoting (a JSON string value such as an
1105+
// apostrophe-bearing name would otherwise corrupt the example).
1106+
func shellSingleQuote(s string) string {
1107+
return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
11001108
}
11011109

11021110
func flagUsage(f specField) string {

0 commit comments

Comments
 (0)