shellwords: Parse strings into words, like a shell would

[ library, mit, text ] [ Propose Tags ]

Downloads

Maintainer's Corner

For package maintainers and hackage trustees

Candidates

  • No Candidates
Versions [RSS] 0.1.0.0, 0.1.1.0, 0.1.2.0, 0.1.2.1, 0.1.2.2, 0.1.3.0
Change log CHANGELOG.md
Dependencies base (>=4.7 && <5), megaparsec (>=6.5.0), text (>=1.2.3.1) [details]
License MIT
Copyright 2018 Patrick Brisbin
Author Patrick Brisbin
Maintainer pbrisbin@gmail.com
Category Text
Home page https://github.com/pbrisbin/hs-shellwords#readme
Bug tracker https://github.com/pbrisbin/hs-shellwords/issues
Source repo head: git clone https://github.com/pbrisbin/hs-shellwords
Uploaded by PatrickBrisbin at 2022-06-23T20:16:34Z
Distributions NixOS:0.1.2.2, Stackage:0.1.3.0
Downloads 2264 total (50 in the last 30 days)
Rating (no votes yet) [estimated by Bayesian average]
Your Rating
  • λ
  • λ
  • λ
Status Docs available [build log]
Last success reported on 2022-06-23 [all 1 reports]

Readme for shellwords-0.1.3.0

[back to package description]

ShellWords

Parse a string into words, like a shell would.

Motivation

If you need to execute commands given to you as user-input, you should know not to give that text as-is to a shell:

callProcess "sh" ["-c", "some --user --input"]

Such code is a severe security vulnerability. Furthermore, any attempts to sanitize the string are unlikely to be 100% affective and should be avoided. The only safe way to do this is to not use a shell intermediary, and always exec a process directly:

callProcess "some" ["--user", "--input"]

The new problem (and not a security-related one) is how to correctly parse a string like "some --user --input" into the command and its arguments. The rules are complex enough that you probably want to get a library to do it.

So here we are.

Example

Right (cmd:args) <- parse "some -complex --command=\"Line And\" 'More'"

callProcess cmd args
--
-- Is equivalent to:
--
-- > callProcess "some" ["-complex", "--command=Line And", "More"]
--

Lineage

This package is inspired by and named after


CHANGELOG | LICENSE