review

Author: mareklibra

src/filemanager/command.c

@@ -11,6 +11,9 @@
    Slava Zanko <slavazanko@gmail.com>, 2013
    Andrew Borodin <aborodin@vmail.ru>, 2011-2022
 
+   Updated by:
+   Marek Libra <libra.marek@gmail.com>, 2026
+
    This file is part of the Midnight Commander.
 
    The Midnight Commander is free software: you can redistribute it
@@ -217,6 +220,9 @@ command_callback (Widget *w, Widget *sender, widget_msg_t msg, int parm, void *d
  *   - Command substitution: $( or ` (including inside double quotes,
  *     where the shell still expands them)
  *
+ * Note: plain parameter expansion ($VAR, ${VAR}) is intentionally excluded
+ * because the internal cd handler expands environment variables itself.
+ *
  * Motivation: the internal cd handler cannot expand command substitutions
  * nor execute compound commands. When any of these constructs are present,
  * the entire command line must be passed to the shell.
@@ -247,22 +253,22 @@ command_has_unquoted_metacharacters (const char *cmd)
             continue;
         }
 
-        if (in_double_quote)
+        if (*p == '\\' && p[1] != '\0')
         {
-            if (*p == '\\' && p[1] != '\0')
-                p++;
-            else if (*p == '"')
-                in_double_quote = FALSE;
-            else if (*p == '`')
-                return TRUE;
-            else if (*p == '$' && p[1] == '(')
-                return TRUE;
+            p++;
             continue;
         }
 
-        if (*p == '\\' && p[1] != '\0')
+        if (*p == '`')
+            return TRUE;
+
+        if (*p == '$' && p[1] == '(')
+            return TRUE;
+
+        if (in_double_quote)
         {
-            p++;
+            if (*p == '"')
+                in_double_quote = FALSE;
             continue;
         }
 
@@ -276,16 +282,10 @@ command_has_unquoted_metacharacters (const char *cmd)
         {
             in_double_quote = TRUE;
             continue;
-    }
+        }
 
         if (*p == ';' || *p == '|' || *p == '&')
             return TRUE;
-
-        if (*p == '`')
-            return TRUE;
-
-        if (*p == '$' && p[1] == '(')
-            return TRUE;
     }
 
     return FALSE;

tests/src/filemanager/has_unquoted_metacharacters.c

@@ -91,6 +91,11 @@ static const struct test_metacharacters_ds
     /* escaped metacharacter plus a real separator */
     { "cd foo\\;bar; make", TRUE },
 
+    /* double-backslash before semicolon: \\; at runtime - first \ escapes second, ; is real */
+    { "cd foo\\\\;ls", TRUE },
+    /* triple-backslash before semicolon: \\\; at runtime - \\ + \; (escaped semicolon) */
+    { "cd foo\\\\\\;ls", FALSE },
+
     /* command substitution $(...) - internal cd cannot expand */
     { "cd $(echo /tmp)", TRUE },
     { "cd $(pwd)", TRUE },