diff options
Diffstat (limited to 'modules/ext/shell.js')
| -rw-r--r-- | modules/ext/shell.js | 73 |
1 files changed, 51 insertions, 22 deletions
diff --git a/modules/ext/shell.js b/modules/ext/shell.js index 8640630..cb26484 100644 --- a/modules/ext/shell.js +++ b/modules/ext/shell.js @@ -108,12 +108,14 @@ class ShellModule { await this.executePipeChain(pipeParts); } else { // Single command — check for shell built-ins first - const parts = chainCmd.split(/\s+/); - const cmd = parts[0].toLowerCase(); + // v4.6.132: quote-aware (split(/\s+/) broke `grep "a b" f; ls`) + const argv = self._tokenize(chainCmd); + if (!argv.length) continue; + const cmd = argv[0].toLowerCase(); // Globs expand at the prompt too — the script runner did it and the // interactive path did not, so `ls *.txt` printed (empty) but the same // line inside a script worked. - const args = self._expandGlobs(parts.slice(1), (this.fs && this.fs.currentPath) || []); + const args = self._expandGlobs(argv.slice(1), (this.fs && this.fs.currentPath) || []); const expandedCmd = [cmd].concat(args).join(' '); if (self.commands[cmd]) { try { @@ -148,9 +150,14 @@ class ShellModule { let pipeInput = null; for (let i = 0; i < pipeParts.length; i++) { const cmdText = pipeParts[i]; - const parts = cmdText.split(/\s+/); - const cmd = parts[0].toLowerCase(); - let args = parts.slice(1); + // v4.6.132: quote-aware tokenisation. split(/\s+/) turned `grep "a b" f | wc -l` + // into args ['"a','b"','f'], and `cmd | | cmd2` into a stage with cmd '' that was + // still dispatched. The security tokeniser keeps a quoted argument whole and + // returns [] for an empty stage, so the guard below can skip it. + const argv = this.security._parseArgs(String(cmdText || '').trim()); + if (argv.length === 0) continue; + const cmd = argv[0].toLowerCase(); + let args = argv.slice(1); // Security gate — replicate the original executePipeChain checks const cls = this.security._classify(cmdText); @@ -203,6 +210,20 @@ class ShellModule { // ── Tokenizer helpers ── + /** + * Split a command line into argv, honouring quotes — the same parser the dispatcher uses + * (`security._parseArgs`), so the shell paths and the bare-command path cannot drift. + * v4.6.132: every `.split(/\s+/)` call site in this file turned a quoted argument into several, + * and dispatched an empty stage as a command named ''. + */ + _tokenize(cmdText) { + const src = String(cmdText || '').trim(); + if (!src) return []; + const sec = (this.terminal && this.terminal.security) || this.security; + if (sec && typeof sec._parseArgs === 'function') return sec._parseArgs(src); + return src.split(/\s+/); // defensive: the terminal always exposes security + } + _splitSequence(input) { // Split on ; (not inside quotes) const parts = []; @@ -350,9 +371,11 @@ class ShellModule { } this.terminal._pipeInput = inputContent; try { - const parts = cmdText.split(/\s+/); - const cmd = parts[0].toLowerCase(); - const args = parts.slice(1); + // v4.6.132: quote-aware — `cat < "/my file.txt"` and `grep "a b" f < x` lost the + // quoted argument to split(/\s+/). + const argv = this._tokenize(cmdText); + const cmd = (argv[0] || '').toLowerCase(); + const args = argv.slice(1); // If command reads files, inject pipe content as temp file if (this._isPipeAware(cmd)) { fs.writeFile('__pipebuf__', inputContent); @@ -393,9 +416,12 @@ class ShellModule { let pipeInput = null; for (let i = 0; i < pipeParts.length; i++) { const pText = pipeParts[i]; - const pParts = pText.split(/\s+/); - const pCmd = pParts[0].toLowerCase(); - const pArgs = pParts.slice(1); + // v4.6.132: tokenise like the interactive path (and keep the raw text, so a + // `js` stage in a script keeps its string literals too). + const pArgv = this._tokenize(pText); + if (!pArgv.length) continue; + const pCmd = pArgv[0].toLowerCase(); + const pArgs = pArgv.slice(1); if (pipeInput !== null) { fs.writeFile('__pipebuf__', pipeInput); } @@ -403,23 +429,24 @@ class ShellModule { let capt = ''; this.terminal._pushPrintCapture(buf => { capt += buf; }); try { - await this.terminal.dispatchCommand(pCmd, pArgs); + await this.terminal.dispatchCommand(pCmd, pArgs, pText); } finally { this.terminal._popPrintCapture(); } pipeInput = capt.trim(); } else { - await this.terminal.dispatchCommand(pCmd, pArgs); + await this.terminal.dispatchCommand(pCmd, pArgs, pText); } if (fs.readFile('__pipebuf__') !== null) { delete fs.root.content['__pipebuf__']; } } } else { - const parts = cmdText.split(/\s+/); - const cmd = parts[0].toLowerCase(); - const args = parts.slice(1); - await this.terminal.dispatchCommand(cmd, args); + // v4.6.132: quote-aware, and pass the raw text so `js`/`node -e` keep literals here too + const argv = this._tokenize(cmdText); + const cmd = (argv[0] || '').toLowerCase(); + const args = argv.slice(1); + await this.terminal.dispatchCommand(cmd, args, cmdText); } } catch(e) { cmdOk = false; @@ -748,7 +775,8 @@ class ShellModule { .trim(); if (!t) return false; const fs = this.terminal.fs; - const parts = t.split(/\s+/); + // v4.6.132: quote-aware — `[ -f "/my file.txt" ]` was false because the path was split. + const parts = this._tokenize(t); const p = parts[1]; switch (parts[0]) { case '-f': return typeof fs.readFile(p) === 'string'; @@ -846,10 +874,11 @@ class ShellModule { } async _dispatchOne(cmdText, env, ctx) { - const parts = String(cmdText).trim().split(/\s+/); - const cmd = (parts[0] || '').toLowerCase(); + // v4.6.132: quote-aware tokenisation (split(/\s+/) split `grep "a b" f` into three args) + const argv = this._tokenize(cmdText); + const cmd = (argv[0] || '').toLowerCase(); const cwd = (this.terminal.fs && this.terminal.fs.currentPath) || []; - const args = this._expandGlobs(parts.slice(1), cwd); + const args = this._expandGlobs(argv.slice(1), cwd); if (this.commands[cmd]) { try { this.terminal.markDirty(); await this.commands[cmd](args); return true; } catch (e) { this.terminal.print('Error: ' + e.message, 'error'); return false; } |