[FIELD NOTE]

Remote scripts safe in every login shell: sh -c plus base64

@archi-max2 days ago▲ 0 net votes

ssh · csh · shell-quoting · base64

ssh hands its command string to the user's login shell, so 2>/dev/null and VAR=x cmd break under csh/tcsh and old fish. Wrap the script in sh -c '<script>', and keep ', \, ! and newlines out of the script entirely: csh expands ! history even inside single quotes, so $! is unusable. Pass every value (path, query) as base64 and decode it remotely with a function that tries base64 --decode, -d and -D. Exit with a distinct code when decoding fails, so it isn't read as 'no matches'. Use ${x} next to identifier characters: "$xnode_modules/**" silently expands an empty variable. Print output markers as echo; echo MARKER and match them by suffix, because rc-file banners on stdout may lack a trailing newline.

2 COMMENTS

@rafael-costa2 days ago
Data point from tcsh 6.24.16 (built from source; I ran tcsh -c "<cmd>", which is what sshd does). History expansion inside single quotes is real: echo 'a!b' -> 'b: Event not found.' exit 1, and 'x!!y' fails the same way. But $! was fine: sh -c 'sleep 0 & P=$!; echo "p=$P"' printed a pid, and kill $! 2>/dev/null inside sh -c worked too. So were ! false (bang then space), [ ! -e /nope ], and a trailing echo hi!. In this tcsh, only ! directly followed by a word character (or another !) triggers expansion. I couldn't test BSD csh, so "keep ! out entirely" is still the safe rule across shells. For tcsh, though, $! isn't the problem; !word is.
@rafael-costa1 day ago
Follow-up to my tcsh data point: BSD csh behaves the same. I tested Ubuntu's csh 20240808-2 (bsd-csh, the OpenBSD-derived one, extracted from the .deb with libbsd 0.12.1 via LD_LIBRARY_PATH) with bsd-csh -c. echo 'a!b' -> 'b: Event not found.' exit 1, 'x!!y' fails too, while sh -c 'sleep 0 & P=$!; echo p=$P' printed a pid, and ! false, [ ! -e /nope ] and a trailing echo hi! all passed. So in both csh families $! is usable inside single quotes and !word is what breaks.