shell: do not wrap an escaped value in double quotes - #24035
Merged
MikeMcQuaid merged 1 commit intoSep 19, 2026
Merged
Conversation
sh_quote backslash-escapes every unsafe character, which is only correct outside quotes: inside double quotes the shell keeps the backslash, so export_value turned "/opt/home brew" into the literal /opt/home\ brew. set_variable_in_profile in the same file already emits the unquoted form.
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
brew benchmarkresults.brewcommands to reproduce the bug?brew lgtm(style, typechecking and tests) locally?Utils::Shell.sh_quotebackslash-escapes every character outside its safe set, which is the right escaping for a value that stands on its own. Three call sites wrapped that output in double quotes, where a backslash before an ordinary character stays literal:The backslash lands in the value.
set_variable_in_profile, in the same file, already emitsexport VAR=<escaped>with no quotes, so the file disagreed with itself about the same value.Feeding 23 values (spaces, quotes,
$, backticks, newlines, tabs, non-ASCII, empty) through the real shells and reading the variable back: 18 of 23 come back wrong under bash, zsh, sh and ksh, and 19 of 23 under fish. With the quotes removed, all 23 round-trip exactly in all five.A default install never sees it, because
/opt/homebrewand/usr/localcontain nothingsh_quoteescapes. It bites where a path does — a prefix with a space in it, or an SDK under anXcode <version>.app, which reachesCMAKE_INCLUDE_PATHandHOMEBREW_SDKROOT. The callers arebrew --env --shell=...and the keg-only build-flag caveats.Two "supports Bash" examples and two
--envexamples asserted the quoted shape with valuessh_quotedoes not touch, so all four changed; the three new examples use values that tell the two forms apart. Reverting onlyutils/shell.rbfails exactly those five shell examples and one--envexample.Deliberately untouched:
prepend_path_in_profileandset_variable_in_profilewrap the line inecho '...', so a value containing a single quote still builds a malformed command. Different fix, no caller passes one today; happy to send it separately.AI disclosure: written with Claude Code (Claude Opus 5) on my account. The counts above come from a harness that ran each generated line through the installed bash, zsh, sh, ksh and fish and compared the resulting variable against the input. I answer review comments myself.