Skip to content

fix(darwin): quote security -i arguments without a shell escaper - #157

Open
SashaMIT wants to merge 1 commit into
zalando:masterfrom
SashaMIT:fix/security-interactive-quote
Open

SashaMIT wants to merge 1 commit into
zalando:masterfrom
SashaMIT:fix/security-interactive-quote

Conversation

@SashaMIT

@SashaMIT SashaMIT commented Oct 11, 2026 •

Copy link
Copy Markdown

Set builds its security -i line with shellescape.Quote. That wrapper is for a POSIX shell. security -i is not one: a backslash takes the next byte literally, including inside single quotes.

A service a\b is stored as ab. Set returns success, and the matching Get returns not found. A single quote produces a line the parser rejects with exit 2.

Each value is now wrapped in double quotes, with backslash and double quote escaped. On a throwaway keychain, 'a\b' is stored as ab and "a\\b" is stored as a\b. A single quote, a double quote, a space, and an empty value round-trip. The POSIX form 'a'"'"'b' still exits 2.

go test -count=1 . passed. Pointing the quoter back at shellescape.Quote fails TestSecurityInteractiveQuote.

The length check in #156 still calls shellescape.Quote on this same line. That call needs this quoter when the two changes meet.

Fixes #154

security -i treats a backslash as an escape inside single quotes, so a POSIX quote stores a\b as ab and rejects a single quote.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

On macOS, shell quoting is used for a parser that is not a shell, so a backslash silently changes the item's name

1 participant