1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

package cmd

import "testing"

func TestShQuote(t *testing.T) {
	cases := []struct {
		in   string
		want string
	}{
		// Basic wrapping
		{"hello", "'hello'"},
		{"", "''"},
		// Spaces and shell meta-chars stay inside single quotes
		{"hello world", "'hello world'"},
		{"$HOME", "'$HOME'"},
		{"`date`", "'`date`'"},
		{"$(rm -rf /)", "'$(rm -rf /)'"},
		// Backslash is literal inside single quotes
		{`back\slash`, `'back\slash'`},
		// Newlines are literal
		{"line1\nline2", "'line1\nline2'"},
		// Single quote: must break out, escape, re-enter
		{"it's", `'it'\''s'`},
		{"''", `''\'''\'''`},
		// Multiple single quotes
		{"a'b'c", `'a'\''b'\''c'`},
	}
	for _, tc := range cases {
		got := shQuote(tc.in)
		if got != tc.want {
			t.Errorf("shQuote(%q) = %q, want %q", tc.in, got, tc.want)
		}
	}
}

// TestShQuote_ShellSafe verifies the output is always safely quoted:
// wrapping the output in a shell assignment should never allow injection.
func TestShQuote_NeverContainsUnquotedSingleQuote(t *testing.T) {
	// After shQuote, the only single quotes in the result should be
	// the surrounding ones or the escape sequence '\''.
	// A naive check: result always starts and ends with ' when no escaping needed.
	dangerous := []string{"$(evil)", "`evil`", "${VAR}", "val;rm -rf /"}
	for _, in := range dangerous {
		got := shQuote(in)
		// Must start and end with single quote
		if len(got) < 2 || got[0] != '\'' || got[len(got)-1] != '\'' {
			t.Errorf("shQuote(%q) = %q: must start and end with single quote", in, got)
		}
	}
}

func TestFishQuote(t *testing.T) {
	cases := []struct {
		in   string
		want string
	}{
		{"hello", "'hello'"},
		{"", "''"},
		{"hello world", "'hello world'"},
		{"$HOME", "'$HOME'"},
		// Fish escapes single quote with backslash-quote
		{"it's", `'it\'s'`},
		{"a'b", `'a\'b'`},
		// Double single quote
		{"''", `'\'\''`},
	}
	for _, tc := range cases {
		got := fishQuote(tc.in)
		if got != tc.want {
			t.Errorf("fishQuote(%q) = %q, want %q", tc.in, got, tc.want)
		}
	}
}