Quotes in sudo commands should be escaped

[mik01aj]

In my flightplan, when I do:

remote.sudo('node -e \'console.log("hello")\'', {user: 'blabla'})

I get an error:

remote $ sudo -u blabla -i bash -c 'node -e 'console.log("hello")''
remote > bash: -c: line 0: syntax error near unexpected token `('
remote > bash: -c: line 0: `sudo -u blabla -i bash -c 'node -e 'console.log("hello")'''

The same command (node -e 'console.log("hello")'), when I try it in bash is valid and works fine.

[mik01aj]

This is actually surprisingly hard. Bash sucks...

http://stackoverflow.com/questions/1250079/how-to-escape-single-quotes-within-single-quoted-strings

[pstadler]

This is indeed rather hard. I wrote quite a lot of shell scripts, maybe I can tackle this at some point.

[qfox]

This would be enough:

function escapeShellArg (cmd) {
    return '\'' + cmd.replace(/\'/g, "'\\''") + '\'';
}

Ref: http://stackoverflow.com/questions/1779858/how-do-i-escape-a-string-for-a-shell-command-in-node

[pstadler]

@zxqfox this seems to be the correct solution indeed. Will try to get a new release ready soon.

[cmckendry]

It looks like the fix for this (specifically the removal of the -c flag) has introduced an error in a portion of our deployment process that uses the sudo functionality to run "chown" on the remote machine. Code is as follows:

remote.sudo("chown -R nobody:nobody " + rootDir + "/application/config/", {user: sudoUser});

In 0.6.4 this works as expected. In 0.6.5 it fails with a No such file or directory error. Is there a change to the format that needs to be made on our side in order to support the new sudo method?

[pstadler]

Hey @cmckendry what's rootDir? I suspect it breaks because you're using a relative path?

[pstadler]

I could verify the error, please ugprade to 0.6.6 which reverts the sudo command to the old behavior.

Thanks for reporting.

[pstadler]

@cmckendry 🍻 https://github.com/pstadler/flightplan/releases/tag/0.6.6

[cmckendry]

Confirmed, that fixed it. Thanks!