Hackage :: [Package]

shellwords: Parse strings into words, like a shell would

[ library, mit, text ] [ Propose Tags ] [ Report a vulnerability ]

Downloads

Note: This package has metadata revisions in the cabal description newer than included in the tarball. To unpack the package including the revisions, use 'cabal get'.

Maintainer's Corner

Package maintainers

For package maintainers and hackage trustees

Candidates

Versions [RSS] 0.1.0.0, 0.1.1.0, 0.1.2.0, 0.1.2.1, 0.1.2.2, 0.1.3.0, 0.1.3.1, 0.1.3.2, 0.1.4.0, 0.1.4.1, 0.1.4.2, 0.1.4.3, 0.1.4.4, 0.1.4.5, 0.1.4.6
Change log CHANGELOG.md
Dependencies base (>=4.11.1.0 && <5), megaparsec (>=7.0.0), text [details]
License MIT
Copyright 2018 Patrick Brisbin
Author Patrick Brisbin
Maintainer pbrisbin@gmail.com
Uploaded by PatrickBrisbin at 2019-02-07T19:23:17Z
Revised Revision 1 made by PatrickBrisbin at 2022-07-20T14:55:12Z
Category Text
Home page https://github.com/pbrisbin/hs-shellwords#readme
Bug tracker https://github.com/pbrisbin/hs-shellwords/issues
Source repo head: git clone https://github.com/pbrisbin/hs-shellwords
Distributions LTSHaskell:0.1.4.6, NixOS:0.1.4.6, Stackage:0.1.4.6
Reverse Dependencies 2 direct, 8 indirect [details]
Downloads 4219 total (47 in the last 30 days)
Rating (no votes yet) [estimated by Bayesian average]
Your Rating
  • λ
  • λ
  • λ
Status Docs available [build log]
Last success reported on 2019-02-07 [all 1 reports]

Readme for shellwords-0.1.2.2

[back to package description]

ShellWords

Parse a string into words, like a shell would.

Motivation

If you need to execute commands given to you as user-input, you should know not to give that text as-is to a shell:

callProcess "sh" ["-c", "some --user --input"]

Such code is a severe security vulnerability. Furthermore, any attempts to sanitize the string are unlikely to be 100% affective and should be avoided. The only safe way to do this is to not use a shell intermediary, and always exec a process directly:

callProcess "some" ["--user", "--input"]

The new problem (and not a security-related one) is how to correctly parse a string like "some --user --input" into the command and its arguments. The rules are complex enough that you probably want to get a library to do it.

So here we are.

Example

Right (cmd:args) <- parse "some -complex --command=\"Line And\" 'More'"

callProcess cmd args
--
-- Is equivalent to:
--
-- > callProcess "some" ["-complex", "--command=Line And", "More"]
--

Lineage

This package is inspired by and named after

CHANGELOG | LICENSE