[GH-ISSUE #43] Fix shell metacharacter handling in wrapper script generation #12

New issue

Closed

opened 2026-03-02 04:07:48 +03:00 by kerem · 1 comment

kerem commented

2026-03-02 04:07:48 +03:00

Owner

Originally created by @gadievron on GitHub (Dec 22, 2025).
Original GitHub issue: https://github.com/gadievron/raptor/issues/43

Problem

Paths with spaces, quotes, or special characters aren't properly escaped, causing wrapper scripts to fail. While RAPTOR is a local tool with user-provided input, proper escaping prevents frustration and potential security issues with paths like /Users/dev/My Projects/app.

Lines 452, 466, 472 in packages/codeql/build_detector.py write repo_path values directly into bash wrapper scripts without shell escaping.

Example Issue

# Repo path with spaces
repo_path = "/Users/dev/My Projects/app"

# Generated wrapper (BREAKS)
#!/bin/bash
cd /Users/dev/My Projects/app  # Fails - spaces not escaped

Impact

Wrapper scripts fail with paths containing special characters
User frustration with common path patterns
Best practice for shell scripting not followed

Fix

Use shlex.quote() to properly escape paths:

from shlex import quote

# At lines 452, 466, 472
cd {quote(str(self.repo_path))}  # Properly escaped

File: packages/codeql/build_detector.py:452, 466, 472

Type

Bug fix + Enhancement (robustness improvement)

Bug #5 from internal analysis
Multi-agent validated

Originally created by @gadievron on GitHub (Dec 22, 2025). Original GitHub issue: https://github.com/gadievron/raptor/issues/43 ## Problem Paths with spaces, quotes, or special characters aren't properly escaped, causing wrapper scripts to fail. While RAPTOR is a local tool with user-provided input, proper escaping prevents frustration and potential security issues with paths like `/Users/dev/My Projects/app`. Lines 452, 466, 472 in `packages/codeql/build_detector.py` write `repo_path` values directly into bash wrapper scripts without shell escaping. ## Example Issue ```bash # Repo path with spaces repo_path = "/Users/dev/My Projects/app" # Generated wrapper (BREAKS) #!/bin/bash cd /Users/dev/My Projects/app # Fails - spaces not escaped ``` ## Impact - Wrapper scripts fail with paths containing special characters - User frustration with common path patterns - Best practice for shell scripting not followed ## Fix Use `shlex.quote()` to properly escape paths: ```python from shlex import quote # At lines 452, 466, 472 cd {quote(str(self.repo_path))} # Properly escaped ``` **File:** `packages/codeql/build_detector.py:452, 466, 472` ## Type - Bug fix + Enhancement (robustness improvement) ## Related - Bug #5 from internal analysis - Multi-agent validated