Output isn't quoted when multipart form values include spaces about h2c HOT 14 CLOSED

Oh right. I think I'll go with always-quoting the string and add escaping for a bunch of sensitive letters. What do you think about that?

from h2c.

I struggle with getting shells to understand me sometimes. Always quoting seems like a good idea.

from h2c.

That also makes letters such as semicolons not needing extra escaping.

from h2c.

Since the fix uses double quotes instead of single quotes, a shell will expand $ variables.

POST / HTTP/1.1
Host: localhost:8000
User-Agent: curl/7.47.0
Accept: */*
Content-Length: 143
Expect: 100-continue
Content-Type: multipart/form-data; boundary=------------------------fdbf5f7d1c2a96b2

--------------------------fdbf5f7d1c2a96b2
Content-Disposition: form-data; name="FOO"

$PATH
--------------------------fdbf5f7d1c2a96b2--

outputs:
curl --http1.1 --user-agent "curl/7.47.0" --form FOO="$PATH" https://localhost:8000/, which is bad.

from h2c.

Adding $ and \ to the regex now. Anything else?

from h2c.

Windows will expand %PATH%. I think single-quoting is the only way to avoid that if the output command should be cross-platform.

from h2c.

The windows command prompt doesn't support single quotes!

from h2c.

So quote % as well?

from h2c.

Impossible...? In Windows, % is quoted with %%, but in a POSIX shell, %% is treated as %%.

from h2c.

Hm, okey, so maybe ignore Windows for now and add an option to make the output "windows compatible" later.

from h2c.

Seems like best effort option is to provide the output suitable for the host platform with the option to generate output for other systems.

Looks like String::ShellQuote is a good bicycle for POSIX platforms.

If external library dependencies is a no-no, then for POSIX shells easiest way seems to use singular quotes so this is the only character that you will have to take care.

Reference: https://stackoverflow.com/a/24869016/7598113

from h2c.

BUGS
Only Bourne shell quoting is supported

... so it won't help us a whole lot.

from h2c.

For Microsoft® Windows™ platforms there is an MSDN blog-post about the wrong ways to do so.

TL;DR: See conclusions at the end of the post, it should enlighten on how to do it properly.

P.S.
It would be more helpful if Microsoft would posted about how to do it in a proper way instead.

from h2c.

still, that requires a "windows output mode" option to quote in that style instead

from h2c.