Is this escaping right?

[tommedema]

Consider this case:

const cmd = `eval ${quote(['find /home -type f -name "*.json" -exec ls -l {} \\;'])} </dev/null 2>&1;`
console.log(cmd)

which results in:

eval 'find / -type f -name "*.json" -exec ls -l {} \\;' </dev/null 2>&1;

which results in:

find: missing argument to `-exec'

Yet when you run the command directly in the shell it works fine because it would be:

eval 'find / -type f -name "*.json" -exec ls -l {} \;' </dev/null 2>&1;

Am I misunderstanding what shell-quote is or is this a bug?

[tommedema]

fyi the issue doesn't occur with https://www.npmjs.com/package/shlex or python's shlex, which escape it as:

eval 'find / -type f -name "*.json" -exec ls -l {} \;' </dev/null 2>&1;

[ljharb]

Your example doesn't use shell-quote?

Per the readme, the library's parse function takes a command. When I do parse(`eval 'find / -type f -name "*.json" -exec ls -l {} \;' </dev/null 2>&1;`), i get an array:

[
  'eval',
  'find / -type f -name "*.json" -exec ls -l {} ;',
  { op: '<' },
  '/dev/null',
  '2',
  { op: '>&' },
  '1',
  { op: ';' }
]