fix: escape shell arg single quotes

README.md

@@ -457,7 +457,9 @@ after fix:
 
 ### .escapeShellArg()
 
-Escape command line arguments. Add single quotes around a string and quotes/escapes any existing single quotes allowing you to pass a string directly to a shell function and having it be treated as a single safe argument.
+Escape POSIX shell command line arguments. Add single quotes around a string and quotes/escapes any existing single quotes allowing you to pass a string directly to a shell function and having it be treated as a single safe argument.
+
+Prefer `child_process.execFile()` or `child_process.spawn()` with an arguments array when possible. This helper is for a single argument in a POSIX shell command string, and is not a Windows `cmd.exe` or PowerShell escaping helper.
 
 ```js
 const ip = '127.0.0.1 && cat /etc/passwd'

README.zh-CN.md

@@ -370,7 +370,9 @@ __处理过程较复杂，性能损耗较大，尽量避免使用__
 
 ### .escapeShellArg()
 
-命令行参数转义。给字符串增加一对单引号并且能引用或者转码任何已经存在的单引号， 这样以确保能够直接将一个字符串传入 shell 函数，并且还是确保安全的。
+POSIX shell 命令行参数转义。给字符串增加一对单引号并且能引用或者转码任何已经存在的单引号， 这样以确保能够直接将一个字符串传入 shell 函数，并且还是确保安全的。
+
+如果可以，优先使用 `child_process.execFile()` 或 `child_process.spawn()` 的参数数组。这个 helper 只用于 POSIX shell 命令字符串里的单个参数，不适用于 Windows `cmd.exe` 或 PowerShell 转义。
 
 ```js
 const ip = '127.0.0.1 && cat /etc/passwd'

package.json

@@ -75,6 +75,10 @@
     "tshy-after": "1",
     "typescript": "5"
   },
+  "overrides": {
+    "fflate": "0.8.2",
+    "urllib": "4.4.0"
+  },
   "scripts": {
     "lint": "eslint --cache src test --ext .ts",
     "pretest": "npm run clean && npm run lint -- --fix",

src/lib/helper/escapeShellArg.ts

@@ -1,4 +1,4 @@
 export default function escapeShellArg(text: string) {
   const str = '' + text;
-  return '\'' + str.replace(/\\/g, '\\\\').replace(/\'/g, '\\\'') + '\'';
+  return '\'' + str.replace(/'/g, '\'\\\'\'') + '\'';
 }

src/lib/utils.ts

@@ -191,7 +191,9 @@ export function preprocessConfig(config: SecurityConfig) {
   });
 }
 
-export function getFromUrl(url: string, prop?: string): string | null {
+export function getFromUrl(url: string): URL | null;
+export function getFromUrl(url: string, prop: string): string | null;
+export function getFromUrl(url: string, prop?: string): URL | string | null {
   try {
     const parsed = new URL(url);
     return prop ? Reflect.get(parsed, prop) : parsed;

test/app/extends/escapeShellArg.test.ts

@@ -1,5 +1,14 @@
+import assert from 'node:assert/strict';
+import { exec as childProcessExec } from 'node:child_process';
+import { promisify } from 'node:util';
+
 import { mm, MockApplication } from '@eggjs/mock';
 
+import escapeShellArg from '../../../src/lib/helper/escapeShellArg.js';
+
+const exec = promisify(childProcessExec);
+const itOnPosix = process.platform === 'win32' ? it.skip : it;
+
 describe('test/app/extends/escapeShellArg.test.ts', () => {
   let app: MockApplication;
   before(() => {
@@ -34,5 +43,12 @@ describe('test/app/extends/escapeShellArg.test.ts', () => {
         .expect(200)
         .expect('true');
     });
+
+    itOnPosix('should keep single quotes inside one shell argument', async () => {
+      const payload = "'; echo EGG_SECURITY_INJECTED; #";
+      const { stdout } = await exec(`printf 'ARG:%s\\n' ${escapeShellArg(payload)}`);
+
+      assert.equal(stdout, 'ARG:\'; echo EGG_SECURITY_INJECTED; #\n');
+    });
   });
 });

test/fixtures/apps/helper-escapeShellArg-app/app/router.js

@@ -6,7 +6,7 @@ module.exports = app => {
 
   app.get('/escapeShellArg-2', async function() {
     const port = '8889\'|chmod 777 /tmp/muma.sh;echo \\';
-    this.body = `cp.exec('./start.sh '+${this.helper.escapeShellArg(port)})` === 'cp.exec(\'./start.sh \'+\'8889\\\'|chmod 777 /tmp/muma.sh;echo \\\\\')';
+    this.body = `cp.exec('./start.sh '+${this.helper.escapeShellArg(port)})` === 'cp.exec(\'./start.sh \'+\'8889\'\\\'\'|chmod 777 /tmp/muma.sh;echo \\\')';
   });
 
   app.get('/escapeShellArg-3', async function() {