Ticket #73: do not intercept 'cd' in compound commands

Skip internal cd handling when the command line contains
unescaped ';', '&&', or '||', letting the shell execute
it instead.

Signed-off-by: Marek Libra <marek.libra@gmail.com>

Author: mareklibra

src/filemanager/command.c

@@ -79,6 +79,73 @@ static const input_colors_t command_colors = {
 /*** file scope functions ************************************************************************/
 /* --------------------------------------------------------------------------------------------- */
 
+/**
+ * Checks if a command string contains unquoted shell metacharacters (;, |, &).
+ * Handles single quotes, double quotes, and backslash escapes.
+ */
+
+gboolean
+has_shell_metacharacters (const char *cmd)
+{
+    gboolean in_single_quote = FALSE;
+    gboolean in_double_quote = FALSE;
+    const char *p;
+    GError *error = NULL;
+
+    if (cmd[0] == '\0')
+        return FALSE;
+
+    if (!g_shell_parse_argv (cmd, NULL, NULL, &error))
+    {
+        g_error_free (error);
+        return TRUE;
+    }
+
+    for (p = cmd; *p != '\0'; p++)
+    {
+        if (in_single_quote)
+        {
+            if (*p == '\'')
+                in_single_quote = FALSE;
+            continue;
+        }
+
+        if (in_double_quote)
+        {
+            if (*p == '\\' && p[1] != '\0')
+                p++;
+            else if (*p == '"')
+                in_double_quote = FALSE;
+            continue;
+        }
+
+        if (*p == '\\' && p[1] != '\0')
+        {
+            p++;
+            continue;
+        }
+
+        if (*p == '\'')
+        {
+            in_single_quote = TRUE;
+            continue;
+        }
+
+        if (*p == '"')
+        {
+            in_double_quote = TRUE;
+            continue;
+        }
+
+        if (*p == ';' || *p == '|' || *p == '&')
+            return TRUE;
+    }
+
+    return FALSE;
+}
+
+/* --------------------------------------------------------------------------------------------- */
+
 /** Handle Enter on the command line
  *
  * @param lc_cmdline string for handling
@@ -102,7 +169,8 @@ enter (WInput *lc_cmdline)
     if (*cmd == '\0')
         return MSG_HANDLED;
 
-    if (strncmp (cmd, "cd", 2) == 0 && (cmd[2] == '\0' || whitespace (cmd[2])))
+    if (strncmp (cmd, "cd", 2) == 0 && (cmd[2] == '\0' || whitespace (cmd[2]))
+        && !has_shell_metacharacters (cmd))
     {
         cd_to (cmd + 2);
         input_clean (lc_cmdline);

src/filemanager/command.h

@@ -21,6 +21,7 @@ extern WInput *cmdline;
 
 WInput *command_new (int y, int x, int len);
 void command_insert (WInput *in, const char *text, gboolean insert_extra_space);
+gboolean has_shell_metacharacters (const char *cmd);
 
 /*** inline functions ****************************************************************************/
 #endif

tests/src/filemanager/Makefile.am

@@ -21,7 +21,8 @@ TESTS = \
 	exec_get_export_variables_ext \
 	ext__exec_make_shell_string \
 	filegui_is_wildcarded \
-	get_random_hint
+	get_random_hint \
+	has_shell_metacharacters
 
 check_PROGRAMS = $(TESTS)
 
@@ -42,3 +43,6 @@ get_random_hint_SOURCES = \
 
 filegui_is_wildcarded_SOURCES = \
 	filegui_is_wildcarded.c
+
+has_shell_metacharacters_SOURCES = \
+	has_shell_metacharacters.c

tests/src/filemanager/has_shell_metacharacters.c

@@ -0,0 +1,115 @@
+/*
+   src/filemanager - tests for has_shell_metacharacters() function
+
+   Copyright (C) 2026
+   Free Software Foundation, Inc.
+
+   This file is part of the Midnight Commander.
+
+   The Midnight Commander is free software: you can redistribute it
+   and/or modify it under the terms of the GNU General Public License as
+   published by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   The Midnight Commander is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#define TEST_SUITE_NAME "/src/filemanager"
+
+#include "tests/mctest.h"
+
+#include "src/filemanager/command.h"
+
+/* --------------------------------------------------------------------------------------------- */
+
+/* @DataSource("test_has_shell_metacharacters_ds") */
+static const struct test_has_shell_metacharacters_ds
+{
+    const char *input_value;
+    gboolean expected_result;
+} test_has_shell_metacharacters_ds[] = {
+    { "", FALSE },
+    { "cd", FALSE },
+    { "cd /tmp", FALSE },
+    { "cd ..", FALSE },
+    { "cd ~/projects", FALSE },
+    { "cd $HOME", FALSE },
+    { "cd -", FALSE },
+    { "cd /path/to/dir", FALSE },
+
+    { "cd ..; make", TRUE },
+    { "cd ..; make; cd -", TRUE },
+    { "cd /tmp; ls", TRUE },
+    { ";", TRUE },
+    { "cd foo;bar", TRUE },
+
+    { "cd .. && make", TRUE },
+    { "cd /tmp && ls && pwd", TRUE },
+    { "&&", TRUE },
+
+    { "cd .. || echo fail", TRUE },
+    { "||", TRUE },
+
+    /* single & and | are shell metacharacters too */
+    { "cd &", TRUE },
+    { "cd foo | bar", TRUE },
+    { "cd a&b", TRUE },
+
+    /* escaped metacharacters should NOT trigger */
+    { "cd foo\\;bar", FALSE },
+    { "cd path\\;with\\;semicolons", FALSE },
+
+    /* escaped semicolon at start of string */
+    { "\\;", FALSE },
+
+    /* mix: escaped semicolons plus a real one */
+    { "cd foo\\;bar; make", TRUE },
+
+    /* quoted metacharacters should NOT trigger */
+    { "cd 'foo;bar'", FALSE },
+    { "cd \"foo;bar\"", FALSE },
+    { "cd 'foo|bar'", FALSE },
+    { "cd 'foo&bar'", FALSE },
+
+    /* unbalanced quotes should trigger (let the shell report the error) */
+    { "cd 'foo", TRUE },
+};
+
+/* @Test(dataSource = "test_has_shell_metacharacters_ds") */
+START_PARAMETRIZED_TEST (test_has_shell_metacharacters, test_has_shell_metacharacters_ds)
+{
+    // given
+    gboolean actual_result;
+
+    // when
+    actual_result = has_shell_metacharacters (data->input_value);
+
+    // then
+    ck_assert_int_eq (actual_result, data->expected_result);
+}
+END_PARAMETRIZED_TEST
+
+/* --------------------------------------------------------------------------------------------- */
+
+int
+main (void)
+{
+    TCase *tc_core;
+
+    tc_core = tcase_create ("Core");
+
+    // Add new tests here: ***************
+    mctest_add_parameterized_test (tc_core, test_has_shell_metacharacters,
+                                   test_has_shell_metacharacters_ds);
+    // ***********************************
+
+    return mctest_run_all (tc_core);
+}
+
+/* --------------------------------------------------------------------------------------------- */