add test, support backslashes

spikecurtis · spikecurtis · commit 364e51118b11 · 2025-06-06T09:51:07.000Z
diff --git a/cli/configssh_internal_test.go b/cli/configssh_internal_test.go
@@ -139,7 +139,7 @@ func Test_sshConfigSplitOnCoderSection(t *testing.T) {
 // This test tries to mimic the behavior of OpenSSH
 // when executing e.g. a ProxyCommand.
 // nolint:tparallel
-func Test_sshConfigExecEscape(t *testing.T) {
+func Test_sshConfigProxyCommandEscape(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
@@ -186,6 +186,60 @@ func Test_sshConfigExecEscape(t *testing.T) {
 	}
 }
 
+// This test tries to mimic the behavior of OpenSSH
+// when executing e.g. a match exec command.
+// nolint:tparallel
+func Test_sshConfigMatchExecEscape(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		path    string
+		wantErr bool
+	}{
+		{"no spaces", "simple", false},
+		{"spaces", "path with spaces", false},
+		{"quotes fails", "path with \"quotes\"", true},
+		{"backslashes", "path with \\backslashes", false},
+		{"tabs", "path with \ttabs", false},
+		{"newline fails", "path with \nnewline", true},
+	}
+	// nolint:paralleltest // Fixes a flake
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			cmd := "/bin/sh"
+			arg := "-c"
+			contents := []byte("#!/bin/sh\necho yay\n")
+			if runtime.GOOS == "windows" {
+				cmd = "cmd.exe"
+				arg = "/c"
+				contents = []byte("echo yay\n")
+			}
+
+			dir := filepath.Join(t.TempDir(), tt.path)
+			err := os.MkdirAll(dir, 0o755)
+			require.NoError(t, err)
+			bin := filepath.Join(dir, "coder.bat") // Windows will treat it as batch, Linux doesn't care
+
+			err = os.WriteFile(bin, contents, 0o755) //nolint:gosec
+			require.NoError(t, err)
+
+			escaped, err := sshConfigMatchExecEscape(bin)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+
+			b, err := exec.Command(cmd, arg, escaped).CombinedOutput() //nolint:gosec
+			require.NoError(t, err)
+			got := strings.TrimSpace(string(b))
+			require.Equal(t, "yay", got)
+		})
+	}
+}
+
 func Test_sshConfigExecEscapeSeparatorForce(t *testing.T) {
 	t.Parallel()
 
diff --git a/cli/configssh_other.go b/cli/configssh_other.go
@@ -26,9 +26,10 @@ func sshConfigMatchExecEscape(path string) (string, error) {
 		return "", xerrors.Errorf("path must not contain quotes: %q", path)
 	}
 
-	// OpenSSH passes the match exec string directly to the user's shell. sh, bash and zsh accept spaces and tabs
-	// simply escaped by a `\`. It's hard to predict exactly what more exotic shells might do, but this should work for
-	// macOS and most Linux distros in their default configuration.
+	// OpenSSH passes the match exec string directly to the user's shell. sh, bash and zsh accept spaces, tabs and
+	// backslashes simply escaped by a `\`. It's hard to predict exactly what more exotic shells might do, but this
+	// should work for macOS and most Linux distros in their default configuration.
+	path = strings.ReplaceAll(path, `\`, `\\`) // must be first, since later replacements add backslashes.
 	path = strings.ReplaceAll(path, " ", "\\ ")
 	path = strings.ReplaceAll(path, "\t", "\\\t")
 	return path, nil
