shellwords

Parse strings into words, like a shell would

https://github.com/pbrisbin/hs-shellwords#readme

Version on this page:	0.1.3.1
LTS Haskell 22.42:	0.1.3.2
Stackage Nightly 2024-11-23:	0.1.3.2
Latest on Hackage:	0.1.3.2

See all snapshots shellwords appears in

MIT licensed by Patrick Brisbin

Maintained by [email protected]

This version can be pinned in stack with:shellwords-0.1.3.1@sha256:4dde2a0390b27e57e5facac9b1e67d5ec40df17054798eb07290d7982121d37d,2236

Module documentation for 0.1.3.1

ShellWords
Text
- Text.Megaparsec
  - Text.Megaparsec.Compat

Depends on 3 packages(full list with versions):

base, megaparsec, text

Used by 1 package in nightly-2024-10-04(full list with versions):

dotenv

ShellWords

Parse a string into words, like a shell would.

Motivation

If you need to execute commands given to you as user-input, you should know not to give that text as-is to a shell:

callProcess "sh" ["-c", "some --user --input"]

Such code is a severe security vulnerability. Furthermore, any attempts to sanitize the string are unlikely to be 100% affective and should be avoided. The only safe way to do this is to not use a shell intermediary, and always exec a process directly:

callProcess "some" ["--user", "--input"]

The new problem (and not a security-related one) is how to correctly parse a string like "some --user --input" into the command and its arguments. The rules are complex enough that you probably want to get a library to do it.

So here we are.

Example

Right (cmd:args) <- parse "some -complex --command=\"Line And\" 'More'"

callProcess cmd args
--
-- Is equivalent to:
--
-- > callProcess "some" ["-complex", "--command=Line And", "More"]
--