Skip to content

fix: quote program and args in debug message from cmd::cmd(..) #9777

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jdx merged 1 commit into from
May 11, 2026
Merged

fix: quote program and args in debug message from cmd::cmd(..) #9777

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions src/cmd.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,13 +90,11 @@ where
let program = program.to_executable();
let args: Vec<OsString> = args.into_iter().map(Into::<OsString>::into).collect();

let display_name = program.to_string_lossy();
let display_args = args
.iter()
.map(|s| s.to_string_lossy())
let display_command = std::iter::once(&program)
.chain(&args)
.map(|s| shell_escape::escape(s.to_string_lossy()))
.collect::<Vec<_>>()
.join(" ");
Comment thread
greptile-apps[bot] marked this conversation as resolved.
Comment on lines +93 to 97

@gemini-code-assist gemini-code-assist Bot May 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This code will fail to compile due to a type mismatch in the chain call. std::iter::once(&program) yields &PathBuf, while &args (as an iterator) yields &OsString. The chain method requires both iterators to have the exact same item type. You can fix this by explicitly converting both to &OsStr using .as_os_str().

Additionally, note that this implementation constructs the display_command string regardless of whether the debug log level is enabled, which is slightly inefficient. Also, the quoting is naive and doesn't handle arguments containing single quotes (e.g., it's a file becomes 'it's a file', which is invalid shell syntax).

Suggested change
let display_command = std::iter::once(&program)
.chain(&args)
.map(|s| format!("'{}'", s.to_string_lossy()))
.collect::<Vec<_>>()
.join(" ");
let display_command = std::iter::once(program.as_os_str())
.chain(args.iter().map(|s| s.as_os_str()))
.map(|s| format!("'{}'", s.to_string_lossy()))
.collect::<Vec<_>>()
.join(" ");

@ktetzlaff ktetzlaff May 11, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This code will fail to compile ...

It compiles (and runs) just fine.

Additionally, note that this implementation constructs the display_command string regardless of whether the debug log level is enabled, which is slightly inefficient.

Yes, but the original code did the same. So I did not see a reason to change that.

Also, the quoting is naive and doesn't handle arguments containing single quotes (e.g., it's a file becomes 'it's a file', which is invalid shell syntax).

Fixed by using shell_escape::escape(..) instead of format!(..).

let display_command = [display_name.into(), display_args].join(" ");
debug!("$ {display_command}");

duct::cmd(program, args)
Expand Down
Loading