Properly escape user commands. By @goebbe (#2171)

borgbase · Dec 16, 2024 · 4e0c555 · 4e0c555
1 parent c64db22
commit 4e0c555
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/src/vorta/borg/borg_job.py b/src/vorta/borg/borg_job.py
@@ -234,7 +234,9 @@ def run(self):
                 profile=self.params.get('profile_id', None),
             )
             log_entry.save()
-            logger.info('Running command %s', ' '.join(self.cmd))
+            cmd_log_tmp = [s.replace(" ", "\\ ") for s in self.cmd]  # escape whitespace - for logs
+            logger.info('Running command %s', ' '.join(cmd_log_tmp))
+            del cmd_log_tmp
 
         p = Popen(
             self.cmd,

diff --git a/src/vorta/borg/create.py b/src/vorta/borg/create.py
@@ -1,4 +1,5 @@
 import os
+import shlex
 import subprocess
 import tempfile
 from datetime import datetime as dt
@@ -102,8 +103,8 @@ def prepare(cls, profile):
         suffix_command = []
         if profile.repo.create_backup_cmd:
             s1, sep, s2 = profile.repo.create_backup_cmd.partition('-- ')
-            extra_cmd_options = s1.split()
-            suffix_command = (sep + s2).split()
+            extra_cmd_options = shlex.split(s1)
+            suffix_command = shlex.split(sep + s2)
 
         if n_backup_folders == 0 and '--paths-from-command' not in extra_cmd_options:
             ret['message'] = trans_late('messages', 'Add some folders to back up first.')