Re: io.popen Run command with spaces in argument filename, and get the result

[Andrew Gierth <andrew@...>]

>>>>> "v" == v  <v19930312@gmail.com> writes:

 >> The logic here is that '...' in POSIX shell quotes every character
 >> except ' itself, without allowing any form of escape, so we replace
 >> ' by the sequence '\'' which closes the existing quote, adds an
 >> escaped ' character, and opens another quote. There are other ways
 >> to do shell quoting but this one is the safest.

 v> Until someone passes \' in as input filename, which makes it break
 v> horribly. E.g.

 v> somefile\';rm -rf /*;echo \'

 v> turns into

 v> otfinfo -p 'somefile\\';rm -rf /*;echo \\''

No it doesn't, it turns into:

otfinfo -p 'somefile\'\'';rm -rf /*;echo \'\'''

Note that \ is not an escape character inside '...' so this is correct.

Perhaps you misunderstood what the [[ ]] do, you certainly didn't try
running the actual code.

-- 
Andrew.