22
33var util = require ( 'util' )
44
5+ var shellQuote = function ( value ) {
6+ // Unless `value` is a simple shell-safe string, quote it.
7+ var shellSafe = / ^ [ a - z 0 - 9 - _ / .@ % ^ = : ] + $ / i
8+ if ( ! shellSafe . test ( value ) ) {
9+ // Use "strong quoting" using single quotes so that we only need
10+ // to deal with nested single quote characters.
11+ // <http://wiki.bash-hackers.org/syntax/quoting#strong_quoting>
12+ return util . format ( "'%s'" , value . replace ( / ' / g, "'\\''" ) )
13+ }
14+ return value
15+ }
16+
517module . exports = function ( source , options ) {
618 var opts = util . _extend ( {
719 queryParams : false ,
@@ -22,7 +34,7 @@ module.exports = function (source, options) {
2234
2335 // start with body pipe
2436 if ( source . postData && source . postData . text ) {
25- code . push ( util . format ( 'echo %s | ' , JSON . stringify ( source . postData . text ) ) )
37+ code . push ( util . format ( 'echo %s | ' , shellQuote ( source . postData . text ) ) )
2638 }
2739
2840 var flags = [ ]
@@ -63,7 +75,7 @@ module.exports = function (source, options) {
6375 flags . push ( util . format ( '--timeout=%s' , opts . timeout ) )
6476 }
6577
66- code . push ( util . format ( 'http %s%s %s' , flags . length ? flags . join ( ' ' ) + ' ' : '' , source . method , opts . queryParams ? source . url : source . fullUrl ) )
78+ code . push ( util . format ( 'http %s%s %s' , flags . length ? flags . join ( ' ' ) + ' ' : '' , source . method , shellQuote ( opts . queryParams ? source . url : source . fullUrl ) ) )
6779
6880 // construct query params
6981 if ( opts . queryParams ) {
@@ -74,23 +86,23 @@ module.exports = function (source, options) {
7486
7587 if ( util . isArray ( value ) ) {
7688 value . map ( function ( val ) {
77- code . push ( util . format ( '%s==%s' , name , val ) )
89+ code . push ( util . format ( '%s==%s' , name , shellQuote ( val ) ) )
7890 } )
7991 } else {
80- code . push ( util . format ( '%s==%s' , name , value ) )
92+ code . push ( util . format ( '%s==%s' , name , shellQuote ( value ) ) )
8193 }
8294 } )
8395 }
8496
8597 // construct headers
8698 Object . keys ( source . allHeaders ) . sort ( ) . map ( function ( key ) {
87- code . push ( util . format ( '%s:%s' , key , source . allHeaders [ key ] ) )
99+ code . push ( util . format ( '%s:%s' , key , shellQuote ( source . allHeaders [ key ] ) ) )
88100 } )
89101
90102 // construct post params
91103 if ( ! source . postData . text && source . postData . params && source . postData . params . length ) {
92104 source . postData . params . map ( function ( param ) {
93- code . push ( util . format ( '%s:%s' , param . name , param . value ) )
105+ code . push ( util . format ( '%s:%s' , param . name , shellQuote ( param . value ) ) )
94106 } )
95107 }
96108
0 commit comments