Re: [PATCH] Add shell-quasiquote.

[Taylan Ulrich Bayırlı/Kammer]

Eli Zaretskii <address@hidden> writes:

>> From: Random832 <address@hidden>
>> Date: Sat, 17 Oct 2015 15:14:26 -0400
>> 
>> Eli Zaretskii <address@hidden> writes:
>> >> From: address@hidden (Taylan Ulrich Bayırlı/Kammer)
>> >> +;;; Like `shell-quote-argument', but much simpler in implementation.
>> >> +(defun shqq--quote-string (string)
>> >> +  (concat "'" (replace-regexp-in-string "'" "'\\\\''" string) "'"))
>> >
>> > It might be simpler, but it's wrong, because the result is only
>> > correct for Posix shells.
>> >
>> > Please do use shell-quote-argument instead.
>> 
>> It's also simpler than the POSIX section of shell-quote-argument.
>
> Simpler doesn't mean correct.

It doesn't, but anyone who knows POSIX shell grammar well should know
that wrapping a string in '', and escaping literal "'"s by turning them
into "'\''" (close so-far single quote, add backslash-escaped single
quote, reopen single quote) is absolutely safe, because absolutely no
character within two single quotes has a special meaning (one cannot
even escape a single quote within two single quotes, hence the
close/insert/reopen).

>> (defun shell-quote-argument (argument)
>>   [...] (cond [...] (t
>>     (if (equal argument "")
>>         "''"
>>       ;; Quote everything except POSIX filename characters.
>>       ;; This should be safe enough even for really weird shells.
>>       (replace-regexp-in-string
>>        "\n" "'\n'"
>>        (replace-regexp-in-string "[^-0-9a-zA-Z_./\n]" "\\\\\\&" 
>> argument))))))
>> 
>> I wonder what "really weird shells" this refers to?
>
> The set of characters special to an arbitrary shell is not known in
> advance.

Yet that piece of code assumes a certain semantics for foo\<newline>bar
(which is that the newline after the backslash is removed instead of
interpreted literally) and special-handles that case, but doesn't
attempt to handle other possible special meanings.

Of course, I'm being pedantic here.  This implementation is probably as
safe as mine.  I'm more worried about the non-POSIX variants because I
have no clue of any non-POSIX shell syntax.

Taylan