fetch, audit: write the verbose curl line and the audit fix --ignore line as shell words

docs/runtime/debugger.mdx

@@ -145,7 +145,7 @@ await fetch("https://example.com", {
 ```
 
 ```txt
-[fetch] $ curl --http1.1 "https://example.com/" -X POST -H "content-type: application/json" -H "Connection: keep-alive" -H "User-Agent: Bun/1.3.3" -H "Accept: */*" -H "Host: example.com" -H "Accept-Encoding: gzip, deflate, br" --compressed -H "Content-Length: 13" --data-raw "{\"foo\":\"bar\"}"
+[fetch] $ curl --http1.1 'https://example.com/' -X POST -H 'content-type: application/json' -H 'Connection: keep-alive' -H 'User-Agent: Bun/1.3.3' -H 'Accept: */*' -H 'Host: example.com' -H 'Accept-Encoding: gzip, deflate, br' --compressed -H 'Content-Length: 13' --data-raw '{"foo":"bar"}'
 [fetch] > HTTP/1.1 POST https://example.com/
 [fetch] > content-type: application/json
 [fetch] > Connection: keep-alive
@@ -169,6 +169,8 @@ await fetch("https://example.com", {
 
 The lines with `[fetch] >` are the request from your local code, and the lines with `[fetch] <` are the response from the remote server.
 
+The `curl` command holds the request as it was sent, with its credentials, so that it can run again. Each argument is quoted for a POSIX shell such as `bash` or `zsh`: the shell passes the bytes of the request to `curl` and runs nothing from them. An argument with a control character (for example a line feed in the body) or with bytes that are not UTF-8 is written as `$'...'`, so the command stays on one line. `dash` and `fish` do not have `$'...'`, and PowerShell reads quotes in another way: these shells can pass other bytes for some arguments, but they also run nothing from them. Do not paste the command into `cmd.exe`, which has no single quotes. `--globoff` is added when the URL has `[`, `]`, `{` or `}`, because `curl` expands them otherwise. A request body with a NUL byte is not printed.
+
 To print without the `curl` command, set `BUN_CONFIG_VERBOSE_FETCH` to `true`.
 
 ```ts index.ts icon="/icons/typescript.svg"

src/bun_core/fmt.rs

@@ -3363,6 +3363,168 @@ fn escape_powershell_impl(str: &[u8], writer: &mut impl fmt::Write) -> fmt::Resu
     write_bytes(writer, remain)
 }
 
+/// One argument of a printed command: a POSIX shell passes `parts` unchanged, fish and PowerShell cannot run them.
+pub struct ShellWord<'a>(pub(crate) &'a [&'a [u8]]);
+
+pub fn shell_word<'a>(parts: &'a [&'a [u8]]) -> ShellWord<'a> {
+    ShellWord(parts)
+}
+
+impl Display for ShellWord<'_> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        let mut empty = true;
+        let mut bare = true;
+        let mut ansi_c = false;
+        for part in self.0 {
+            empty &= part.is_empty();
+            for chunk in part.utf8_chunks() {
+                ansi_c |= !chunk.invalid().is_empty();
+                for c in chunk.valid().chars() {
+                    bare &= c.is_ascii_alphanumeric() || c == '-';
+                    // C0, DEL and C1.
+                    ansi_c |= matches!(c, '\0'..='\x1f' | '\x7f'..='\u{9f}');
+                }
+            }
+        }
+
+        if ansi_c {
+            // `'...'` would put a line feed, ESC or CR on the terminal as it is.
+            f.write_str("$'")?;
+            self.0
+                .iter()
+                .try_for_each(|part| shell_word_ansi_c(f, part))?;
+            f.write_str("'")
+        } else if empty {
+            f.write_str("''")
+        } else if bare {
+            self.0.iter().try_for_each(|part| shell_word_utf8(f, part))
+        } else {
+            let mut quoted = ShellWordQuoted {
+                f,
+                state: ShellWordIn::Nothing,
+                held_backslash: false,
+            };
+            self.0.iter().try_for_each(|part| quoted.part(part))?;
+            quoted.finish()
+        }
+    }
+}
+
+fn shell_word_utf8(f: &mut Formatter<'_>, bytes: &[u8]) -> fmt::Result {
+    f.write_str(core::str::from_utf8(bytes).map_err(|_| fmt::Error)?)
+}
+
+/// The inside of `$'...'`, all ASCII: a GBK or Big5 shell cannot pair a byte with the backslash of the next escape.
+fn shell_word_ansi_c(f: &mut Formatter<'_>, part: &[u8]) -> fmt::Result {
+    let mut run = 0;
+    for (i, &byte) in part.iter().enumerate() {
+        let escape = match byte {
+            b'\\' => "\\\\",
+            b'\n' => "\\n",
+            b'\r' => "\\r",
+            b'\t' => "\\t",
+            // dash, fish and PowerShell read `$'...'` as `'...'`: a `'` is `\047`, never `\'`.
+            b' '..=b'~' if byte != b'\'' => continue,
+            _ => "",
+        };
+        shell_word_utf8(f, &part[run..i])?;
+        if escape.is_empty() {
+            write!(f, "\\{byte:03o}")?;
+        } else {
+            f.write_str(escape)?;
+        }
+        run = i + 1;
+    }
+    shell_word_utf8(f, &part[run..])
+}
+
+#[derive(Clone, Copy, PartialEq)]
+enum ShellWordIn {
+    Single,
+    Double,
+    Nothing,
+}
+
+/// `'...'` runs, for UTF-8 without a control character.
+struct ShellWordQuoted<'a, 'f> {
+    f: &'a mut Formatter<'f>,
+    state: ShellWordIn,
+    /// A backslash that waits for the byte after it.
+    held_backslash: bool,
+}
+
+impl ShellWordQuoted<'_, '_> {
+    fn enter(&mut self, next: ShellWordIn) -> fmt::Result {
+        let delimiter = |state| match state {
+            ShellWordIn::Single => "'",
+            ShellWordIn::Double => "\"",
+            ShellWordIn::Nothing => "",
+        };
+        if self.state != next {
+            self.f.write_str(delimiter(self.state))?;
+            self.f.write_str(delimiter(next))?;
+            self.state = next;
+        }
+        Ok(())
+    }
+
+    fn settle_backslash(&mut self, stays_quoted: bool) -> fmt::Result {
+        if !core::mem::take(&mut self.held_backslash) {
+            Ok(())
+        } else if stays_quoted {
+            self.enter(ShellWordIn::Single)?;
+            self.f.write_str("\\")
+        } else {
+            // fish reads `\\` and `\'` inside `'...'` as escapes. Outside, `\\` is one backslash in every shell.
+            self.enter(ShellWordIn::Nothing)?;
+            self.f.write_str("\\\\")
+        }
+    }
+
+    fn part(&mut self, mut rest: &[u8]) -> fmt::Result {
+        // A backslash, a `'`, or U+2018..=U+201B: PowerShell ends a `'...'` string at those too.
+        fn special(rest: &[u8]) -> Option<(usize, usize)> {
+            let mut from = 0;
+            while let Some(at) = strings::index_of_any_pos(rest, b"\\'\xe2", from) {
+                match &rest[at..] {
+                    [b'\\' | b'\'', ..] => return Some((at, 1)),
+                    [0xe2, 0x80, 0x98..=0x9b, ..] => return Some((at, 3)),
+                    _ => from = at + 1,
+                }
+            }
+            None
+        }
+
+        while let Some((at, len)) = special(rest) {
+            if at > 0 {
+                self.settle_backslash(true)?;
+                self.enter(ShellWordIn::Single)?;
+                shell_word_utf8(self.f, &rest[..at])?;
+            }
+            self.settle_backslash(false)?;
+            if rest[at] == b'\\' {
+                self.held_backslash = true;
+            } else {
+                // Not `'\''`: PowerShell leaves the text after it outside any string.
+                self.enter(ShellWordIn::Double)?;
+                shell_word_utf8(self.f, &rest[at..at + len])?;
+            }
+            rest = &rest[at + len..];
+        }
+        if !rest.is_empty() {
+            self.settle_backslash(true)?;
+            self.enter(ShellWordIn::Single)?;
+            shell_word_utf8(self.f, rest)?;
+        }
+        Ok(())
+    }
+
+    fn finish(&mut self) -> fmt::Result {
+        self.settle_backslash(false)?;
+        self.enter(ShellWordIn::Nothing)
+    }
+}
+
 // js_bindings (fmtString for highlighter.test.ts) lives in src/jsc/fmt_jsc.rs
 // alongside fmt_jsc.bind.ts; bun_core/ stays JSC-free.
 

src/install/audit_fix.rs

@@ -1002,16 +1002,19 @@ impl FixPlan {
                 print_tokens(&item.ignore_tokens);
                 prettyln!("<r>");
                 for token in &item.ignore_tokens {
-                    if !all_tokens.contains(token) {
+                    if !token.is_empty() && !all_tokens.contains(token) {
                         all_tokens.push(token.clone());
                     }
                 }
             }
-            pretty!("    <cyan>bun audit fix");
-            for token in &all_tokens {
-                pretty!(" --ignore {}", BStr::new(token));
+            if !all_tokens.is_empty() {
+                pretty!("    <cyan>bun audit fix");
+                for token in &all_tokens {
+                    // The token is the registry's text, and this line is there to be pasted.
+                    pretty!(" --ignore {}", bun_core::fmt::shell_word(&[token]));
+                }
+                prettyln!("<r>");
             }
-            prettyln!("<r>");
             prettyln!("");
         }
         if !self.unmatched.is_empty() {

src/picohttp/lib.rs

@@ -4,6 +4,7 @@ use core::fmt;
 
 use bstr::BStr;
 
+use bun_core::fmt::shell_word;
 use bun_core::output::enable_ansi_colors_stderr;
 use bun_core::pretty_fmt;
 
@@ -205,12 +206,11 @@ impl fmt::Display for HeaderCurlFormatter<'_> {
         if header.value_len > 0 {
             write!(
                 f,
-                "-H \"{}: {}\"",
-                BStr::new(header.name()),
-                BStr::new(header.value())
+                "-H {}",
+                shell_word(&[header.name(), b": ", header.value()])
             )
         } else {
-            write!(f, "-H \"{}\"", BStr::new(header.name()))
+            write!(f, "-H {}", shell_word(&[header.name()]))
         }
     }
 }
@@ -330,8 +330,9 @@ pub struct RequestCurlFormatter<'a> {
 }
 
 impl<'a> RequestCurlFormatter<'a> {
-    fn is_printable_body(content_type: &[u8]) -> bool {
-        if content_type.is_empty() {
+    fn is_printable_body(content_type: &[u8], body: &[u8]) -> bool {
+        // No argument of a command can hold a NUL.
+        if content_type.is_empty() || body.is_empty() || strings::contains_char(body, 0) {
             return false;
         }
 
@@ -345,20 +346,27 @@ impl<'a> RequestCurlFormatter<'a> {
 impl fmt::Display for RequestCurlFormatter<'_> {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let request = self.request;
+        let url = [request.path];
+        let url = shell_word(&url);
         if enable_ansi_colors_stderr() {
             f.write_str(pretty_fmt!("<r><d>[fetch] $<r> ", true))?;
 
             write!(
                 f,
-                pretty_fmt!("<b><cyan>curl<r> <d>--http1.1<r> <b>\"{}\"<r>", true),
-                BStr::new(request.path),
+                pretty_fmt!("<b><cyan>curl<r> <d>--http1.1<r> <b>{}<r>", true),
+                url,
             )?;
         } else {
-            write!(f, "curl --http1.1 \"{}\"", BStr::new(request.path))?;
+            write!(f, "curl --http1.1 {}", url)?;
+        }
+
+        // curl expands `[1-3]` and `{a,b}` in a URL unless globbing is off.
+        if strings::index_of_any(request.path, b"[]{}").is_some() {
+            f.write_str(" --globoff")?;
         }
 
         if request.method != b"GET" {
-            write!(f, " -X {}", BStr::new(request.method))?;
+            write!(f, " -X {}", shell_word(&[request.method]))?;
         }
 
         if self.ignore_insecure {
@@ -382,13 +390,8 @@ impl fmt::Display for RequestCurlFormatter<'_> {
             }
         }
 
-        if !self.body.is_empty() && Self::is_printable_body(content_type) {
-            f.write_str(" --data-raw ")?;
-            bun_core::js_printer::write_json_string(
-                self.body,
-                f,
-                bun_core::strings::Encoding::Utf8,
-            )?;
+        if Self::is_printable_body(content_type, self.body) {
+            write!(f, " --data-raw {}", shell_word(&[self.body]))?;
         }
 
         Ok(())

src/runtime/cli/audit_command.rs

@@ -1016,10 +1016,18 @@ fn keep_vulnerability(
 }
 
 fn ignore_token(vulnerability: &VulnerabilityInfo) -> Box<[u8]> {
-    match strings::index_of(&vulnerability.url, b"GHSA-") {
-        Some(i) => Box::from(&vulnerability.url[i..]),
-        None => vulnerability.id.clone(),
+    if let Some(i) = strings::index_of(&vulnerability.url, b"GHSA-") {
+        // The id, not the rest of the url after it.
+        let id = &vulnerability.url[i..];
+        let len = id
+            .iter()
+            .position(|byte| !(byte.is_ascii_alphanumeric() || *byte == b'-'))
+            .unwrap_or(id.len());
+        if len > b"GHSA-".len() {
+            return Box::from(&id[..len]);
+        }
     }
+    vulnerability.id.clone()
 }
 
 fn to_advisory(vulnerability: VulnerabilityInfo) -> Advisory {

test/cli/install/bun-audit.test.ts

@@ -7,10 +7,12 @@ import {
   bunEnv,
   bunExe,
   gunzipJsonRequest,
+  isWindows,
   normalizeBunSnapshot,
   runBunInstall,
   tempDir,
 } from "harness";
+import { readdirSync } from "node:fs";
 import { join } from "node:path";
 import { resolveBulkAdvisoryFixture } from "./registry/fixtures/audit/audit-fixtures";
 
@@ -1832,6 +1834,61 @@ describe("`bun audit fix`", () => {
     await runBunInstall(installEnv(dir), dir, { frozenLockfile: true });
   });
 
+  // The advisory's `url` and `id` are the registry's text, and the `--ignore` line is printed to be pasted.
+  test.concurrent("the --ignore line takes each advisory as one shell word", async () => {
+    const ghsa = "GHSA-xxxx-xxxx-xxxx";
+    const id = "2 --latest; touch pwned";
+    await using server = startRegistry({
+      "a-dep": [
+        { ...adv("<=1.0.10"), url: "https://example.invalid/" + ghsa + ";touch${IFS}pwned" },
+        { ...adv("<=1.0.10"), id: id as unknown as number },
+      ],
+    });
+    using dir = await setup(server, { name: "foo", dependencies: { "a-dep": "^1.0.0" } });
+
+    const { stdout, exitCode } = await auditFix(dir);
+    expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
+      "bun audit fix <version> (<revision>)
+
+      no published version fixes:
+        a-dep@1.0.10  2 --latest; touch pwned, GHSA-xxxx-xxxx-xxxx
+          bun audit fix --ignore '2 --latest; touch pwned' --ignore GHSA-xxxx-xxxx-xxxx
+
+      Fixed 0 of 2 vulnerabilities (checked 1)
+      2 vulnerabilities remaining"
+    `);
+    expect(exitCode).toBe(1);
+
+    if (!isWindows) {
+      // Paste the line: `bun` is a function that prints its arguments.
+      const line = stdout.split("\n").find(line => line.includes("--ignore"))!;
+      using cwd = tempDir("audit-ignore-paste", {});
+      await using sh = Bun.spawn({
+        cmd: ["sh", "-c", `bun() { printf '[%s]\\n' "$@"; }\n${line}`],
+        env: bunEnv,
+        cwd: String(cwd),
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [pasted, stderr, shExitCode] = await Promise.all([sh.stdout.text(), sh.stderr.text(), sh.exited]);
+      expect({ pasted, stderr, shExitCode, created: readdirSync(String(cwd)) }).toEqual({
+        pasted: ["audit", "fix", "--ignore", id, "--ignore", ghsa].map(word => `[${word}]\n`).join(""),
+        stderr: "",
+        shExitCode: 0,
+        created: [],
+      });
+    }
+
+    // The printed tokens are what `--ignore` takes.
+    const ignored = await auditFix(dir, "--ignore", id, "--ignore", ghsa);
+    expect(normalizeBunSnapshot(ignored.stdout)).toMatchInlineSnapshot(`
+      "bun audit fix <version> (<revision>)
+
+      No vulnerabilities found (checked 1 package, 2 ignored)"
+    `);
+    expect(ignored.exitCode).toBe(0);
+  });
+
   // pnpm#11101: a workspace package sharing a name with an advised npm package is not audited.
   test.concurrent("a workspace package is never matched against an advisory for its name", async () => {
     await using server = startRegistry({ "no-deps": [adv("<1.0.1")] });