From 239f480cbb7db0ff1b1952ba2c33256b01f096d8 Mon Sep 17 00:00:00 2001 From: Asher Haig Date: Sat, 21 Mar 2026 21:35:25 -0400 Subject: [PATCH] Use shlex.quote for shell argument escaping on POSIX quote_arg() only wrapped arguments containing spaces in double quotes. Shell metacharacters ($, backtick, ;, |, &, etc.) were left unescaped. On POSIX, use shlex.quote() which single-quotes to prevent all shell interpretation. Retain original Windows behavior since cmd.exe does not interpret single-quoted strings. --- src/solidlsp/util/subprocess_util.py | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/src/solidlsp/util/subprocess_util.py b/src/solidlsp/util/subprocess_util.py index c0735f0c..175ae1e9 100644 --- a/src/solidlsp/util/subprocess_util.py +++ b/src/solidlsp/util/subprocess_util.py @@ -1,4 +1,5 @@ import platform +import shlex import subprocess @@ -15,8 +16,14 @@ def subprocess_kwargs() -> dict: def quote_arg(arg: str) -> str: """ - Adds quotes around an argument if it contains spaces. + Quotes a shell argument to prevent interpretation of metacharacters. + + Uses :func:`shlex.quote` on POSIX systems for proper escaping of all + shell-special characters. On Windows, wraps arguments containing spaces + in double quotes (Windows shell does not interpret single-quoted strings). """ - if " " not in arg: - return arg - return f'"{arg}"' + if platform.system() == "Windows": + if " " not in arg: + return arg + return f'"{arg}"' + return shlex.quote(arg)