Re: [PATCH] Add shell-quasiquote.

[Random832]

Paul Eggert <address@hidden> writes:

> Taylan Ulrich Bayırlı/Kammer wrote:
>> You seem to be implying that using shell-quote-argument will uphold the
>> invariant that the code is safe against injection.  I'm asking for
>> explicit confirmation of that.
>
> Yes, it's safe. In contrast, the version you proposed is not safe for
> really weird csh-like shells, where it can mishandle '!'.

If supporting csh-like shells is a concern, I'll point out that the
newline mishandling I noted in another post allows one to, at least,
inject an arbitrary command with no arguments:

(call-process "csh" nil t "csh" "-c"
              (concat "echo " (shell-quote-argument
              "\nevil-command\n")))
Unmatched '.
evil-command: Command not found.
Unmatched '.
1