fix more shell scripts; add test

Author: gcurtis

internal/devbox/devbox.go

@@ -270,15 +270,16 @@ func (d *Devbox) RunScript(ctx context.Context, envOpts devopt.EnvOptions, cmdNa
 	// better alternative since devbox run and devbox shell are not the same.
 	env["DEVBOX_SHELL_ENABLED"] = "1"
 
-	// wrap the arg in double-quotes, and escape any double-quotes inside it
-	for idx, arg := range cmdArgs {
-		cmdArgs[idx] = strconv.Quote(arg)
-	}
-
-	var cmdWithArgs []string
+	cmdString := ""
 	if _, ok := d.cfg.Scripts()[cmdName]; ok {
 		// it's a script, so replace the command with the script file's path.
-		cmdWithArgs = append([]string{shellgen.ScriptPath(d.ProjectDir(), cmdName)}, cmdArgs...)
+		cmdBuilder := strings.Builder{}
+		writeQuoted(&cmdBuilder, shellgen.ScriptPath(d.ProjectDir(), cmdName))
+		for _, arg := range cmdArgs {
+			cmdBuilder.WriteByte(' ')
+			writeQuoted(&cmdBuilder, arg)
+		}
+		cmdString = cmdBuilder.String()
 	} else {
 		// Arbitrary commands should also run the hooks, so we write them to a file as well. However, if the
 		// command args include env variable evaluations, then they'll be evaluated _before_ the hooks run,
@@ -293,11 +294,21 @@ func (d *Devbox) RunScript(ctx context.Context, envOpts devopt.EnvOptions, cmdNa
 		if err != nil {
 			return err
 		}
-		cmdWithArgs = []string{shellgen.ScriptPath(d.ProjectDir(), arbitraryCmdFilename)}
-		env["DEVBOX_RUN_CMD"] = strings.Join(append([]string{cmdName}, cmdArgs...), " ")
+
+		cmdBuilder := strings.Builder{}
+		writeQuoted(&cmdBuilder, shellgen.ScriptPath(d.ProjectDir(), arbitraryCmdFilename))
+		cmdString = cmdBuilder.String()
+
+		cmdBuilder.Reset()
+		writeQuoted(&cmdBuilder, cmdName)
+		for _, arg := range cmdArgs {
+			cmdBuilder.WriteByte(' ')
+			writeQuoted(&cmdBuilder, arg)
+		}
+		env["DEVBOX_RUN_CMD"] = cmdBuilder.String()
 	}
 
-	return nix.RunScript(d.projectDir, strings.Join(cmdWithArgs, " "), env)
+	return nix.RunScript(d.projectDir, cmdString, env)
 }
 
 // Install ensures that all the packages in the config are installed

internal/devbox/envvars.go

@@ -33,20 +33,40 @@ func exportify(vars map[string]string) string {
 		strb.WriteString("export ")
 		strb.WriteString(k)
 		strb.WriteString(`="`)
-		for _, r := range vars[k] {
-			switch r {
-			// Special characters inside double quotes:
-			// https://pubs.opengroup.org/onlinepubs/009604499/utilities/xcu_chap02.html#tag_02_02_03
-			case '$', '`', '"', '\\', '\n':
-				strb.WriteRune('\\')
-			}
-			strb.WriteRune(r)
-		}
+		writeQuoted(&strb, vars[k])
 		strb.WriteString("\";\n")
 	}
 	return strings.TrimSpace(strb.String())
 }
 
+func writeQuoted(dst *strings.Builder, str string) {
+	needsQuote := strings.ContainsAny(str, ";\"'()$|&><` \t\r\n\\#{~*?[=")
+	if !needsQuote {
+		dst.WriteString(str)
+		return
+	}
+
+	canSingleQuote := !strings.Contains(str, "'")
+	if canSingleQuote {
+		dst.WriteByte('\'')
+		dst.WriteString(str)
+		dst.WriteByte('\'')
+		return
+	}
+
+	dst.WriteByte('"')
+	for _, r := range str {
+		switch r {
+		// Special characters inside double quotes:
+		// https://pubs.opengroup.org/onlinepubs/009604499/utilities/xcu_chap02.html#tag_02_02_03
+		case '$', '`', '"', '\\':
+			dst.WriteRune('\\')
+		}
+		dst.WriteRune(r)
+	}
+	dst.WriteByte('"')
+}
+
 // addEnvIfNotPreviouslySetByDevbox adds the key-value pairs from new to existing,
 // but only if the key was not previously set by devbox
 // Caveat, this won't mark the values as set by devbox automatically. Instead,

internal/devbox/shellrc_fish.tmpl

@@ -59,7 +59,7 @@ set workingDir (pwd)
 cd "{{ .ProjectDir }}" || exit
 
 # Source the hooks file, which contains the project's init hooks and plugin hooks.
-source {{ .HooksFilePath }}
+source "{{ .HooksFilePath }}"
 
 cd "$workingDir" || exit
 

internal/shellgen/tmpl/script-wrapper.tmpl

@@ -1,5 +1,5 @@
-{{/* 
-    This wraps user scripts in devbox.json. The idea is to only run the init 
+{{/*
+    This wraps user scripts in devbox.json. The idea is to only run the init
     hooks once, even if the init hook calls devbox run again. This will also
     protect against using devbox service in the init hook.
 
@@ -8,7 +8,7 @@
 */ -}}
 
 if [ -z "${{ .SkipInitHookHash }}" ]; then
-    . {{ .InitHookPath }}
+    . "{{ .InitHookPath }}"
 fi
 
 {{ .Body }}

testscripts/basic/path_whitespace.test.txt

@@ -0,0 +1,23 @@
+# Test that Devbox handles whitespace in project paths.
+
+mkdir 'my project'
+cd 'my project'
+
+exec devbox run -- hello
+stdout 'Hello, world!'
+
+exec devbox run -- touch 'file1 with spaces'
+exists 'file1 with spaces'
+
+exec devbox run test
+exists 'file2 with spaces'
+
+-- my project/devbox.json --
+{
+  "packages": ["hello@latest"],
+  "shell": {
+    "scripts": {
+      "test": "touch 'file2 with spaces'"
+    }
+  }
+}