fix: escape ampersand and question mark in ProxyCommand

kylecarbs · kylecarbs · commit 565fd784a620 · 2024-09-13T13:16:10.000-04:00
Fixes #479.
diff --git a/src/main/kotlin/com/coder/gateway/util/Escape.kt b/src/main/kotlin/com/coder/gateway/util/Escape.kt
@@ -12,8 +12,10 @@ fun escape(s: String): String {
     if (s.contains("\n")) {
         throw Exception("argument cannot contain newlines")
     }
-    if (s.contains(" ") || s.contains("\t")) {
-        return "\"" + s.replace("\"", "\\\"") + "\""
+    if (s.contains(" ") || s.contains("\t") || s.contains("&") || s.contains("?")) {
+        // See https://github.com/coder/jetbrains-coder/issues/479
+        // Escape existing " and &
+        return "\"" + s.replace("\"", "\\\"").replace("&", "\\&").replace("?", "\\?") + "\""
     }
     return s.replace("\"", "\\\"")
 }

Original file line number	Diff line number	Diff line change
`@@ -12,8 +12,10 @@ fun escape(s: String): String {`
`12`	`12`	`if (s.contains("\n")) {`
`13`	`13`	`throw Exception("argument cannot contain newlines")`
`14`	`14`	`}`
`15`		`- if (s.contains(" ") \|\| s.contains("\t")) {`
`16`		`- return "\"" + s.replace("\"", "\\\"") + "\""`
	`15`	`+ if (s.contains(" ") \|\| s.contains("\t") \|\| s.contains("&") \|\| s.contains("?")) {`
	`16`	`+ // See https://github.com/coder/jetbrains-coder/issues/479`
	`17`	`+ // Escape existing " and &`
	`18`	`+ return "\"" + s.replace("\"", "\\\"").replace("&", "\\&").replace("?", "\\?") + "\""`
`17`	`19`	`}`
`18`	`20`	`return s.replace("\"", "\\\"")`
`19`	`21`	`}`