[GH-ISSUE #918] escaping issue with custom field string replacement #566

New issue

Closed

opened 2026-03-02 02:17:17 +03:00 by kerem · 1 comment

kerem commented

2026-03-02 02:17:17 +03:00

Owner

Originally created by @bbrendon on GitHub (Jan 5, 2022).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/918

Originally assigned to: @sadnub on GitHub.

Describe the bug

Puting a custom field with a value like asdf\basdf and passing that custom field to a power shell script as a parameter you get output like:

BUT
If you don't use a custom field, and just enter it as a parameter to a power shell script, the \b doesn't corrupt.

I'm thinking this is fixable? Seems like it should be.

Create a Simple powershell script in tactical:

param ($MYARG) 
Write-Host "MYARG PARAM: $MYARG"

call it with Args : -MYARG asdf\basdf
...Which should work.

Put asdf\basdf into custom field
call script with arg: `-MYARG {{agent.FIELD}}

You should get the corrupt output.

Originally created by @bbrendon on GitHub (Jan 5, 2022). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/918 Originally assigned to: @sadnub on GitHub. **Describe the bug** Puting a custom field with a value like `asdf\basdf` and passing that custom field to a power shell script as a parameter you get output like: ![image](https://user-images.githubusercontent.com/6364477/148306409-fd576d5e-e699-414f-9875-9477e531bf47.png) BUT If you don't use a custom field, and just enter it as a parameter to a power shell script, the `\b` doesn't corrupt. I'm thinking this is fixable? Seems like it should be. Create a Simple powershell script in tactical: ``` param ($MYARG) Write-Host "MYARG PARAM: $MYARG" ``` call it with Args : `-MYARG asdf\basdf` ...Which should work. Put `asdf\basdf` into custom field call script with arg: `-MYARG {{agent.FIELD}} You should get the corrupt output.

kerem

2026-03-02 02:17:17 +03:00

closed this issue
added the
bug

dev-triage
labels

kerem commented

2026-03-02 02:17:18 +03:00

Author

Owner

@sadnub commented on GitHub (Aug 14, 2022):

Any text in custom fields must be escaped manually. This will break other properties like newlines, tabs, etc if I escape all backslashes. It will also break existing functionality if someone is already escaping output.

@sadnub commented on GitHub (Aug 14, 2022): Any text in custom fields must be escaped manually. This will break other properties like newlines, tabs, etc if I escape all backslashes. It will also break existing functionality if someone is already escaping output.

kerem referenced this issue

2026-03-14 03:29:07 +03:00

[GH-ISSUE #566] [feature request] patch managementt #2303