Skip to content

Bug: make all collected args use single quote #11609

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cstamas wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Bug: make all collected args use single quote #11609

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apache-maven/src/assembly/maven/bin/mvn
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -291,7 +291,7 @@ cmd="\"$JAVACMD\" \

# Add remaining arguments with proper quoting
for arg in "$@"; do
cmd="$cmd \"$arg\""
cmd="$cmd '$arg'"

@michael-o michael-o Jan 30, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This changes semantics "@" does already the quoting for us. I think this needs an IT.

@cstamas cstamas Jan 31, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, according to your comment, this change is not needed and the issue it fixes is fluke?

@michael-o michael-o Jan 31, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't say its fluke, but we need to understand what this change causes and an IT with it. I wouldn't easily apply it.

@gnodet gnodet May 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Arguments containing literal single quotes will break here. For example, -Dprop="it's a value" produces the cmd fragment 'it's a value', which eval will mispars as three tokens.

The previous approach of passing '"$@"' to eval was safer because "$@" preserves each argument exactly as received by the shell, with no re-quoting needed.

If the goal is to prevent ${...} expansion during eval, the safest fix would be to escape the problematic characters inside double quotes rather than switching to single quotes:

Suggested change
cmd="$cmd '$arg'"
cmd="$cmd \"$(printf '%s' "$arg" | sed "s/'/'\\\\''/g")\""

...though honestly keeping the current eval exec "$cmd" '"$@"' approach and investigating why ${...} was being expanded there would be the better path.

done

if [ -n "$MAVEN_DEBUG_SCRIPT" ]; then
Expand Down