From 94da305b175dc208f32e3463de9017cb2b847624 Mon Sep 17 00:00:00 2001 From: "Bastian (BaM)" Date: Sun, 14 Sep 2025 20:16:27 +0200 Subject: [PATCH] Quote remote commands in SSH execution to prevent shell interpretation of special characters --- scripts/ssh.lua | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/scripts/ssh.lua b/scripts/ssh.lua index de5435a..8cbb80b 100644 --- a/scripts/ssh.lua +++ b/scripts/ssh.lua @@ -44,7 +44,8 @@ function ssh_module.execute(command, user, host, port, identity_file) -- Pass remote command as provided; caller is responsible for proper quoting table.insert(pieces, "--") - table.insert(pieces, command) + -- Quote the remote command to prevent shell interpretation of && and || + table.insert(pieces, "'" .. command:gsub("'", "'\\''") .. "'") -- Join with spaces for os.execute local function join(args) @@ -97,7 +98,8 @@ function ssh_module.execute_with_output(command, user, host, port, identity_file -- Pass remote command as provided table.insert(pieces, "--") - table.insert(pieces, command) + -- Quote the remote command to prevent shell interpretation of && and || + table.insert(pieces, "'" .. command:gsub("'", "'\\''") .. "'") -- Join with spaces for io.popen local function join(args)