Skip to content

[v2] Double-quote Windows alias command args if metacharacters present#10223

Merged
hssyoo merged 3 commits intov2from
alias-escape
Apr 17, 2026
Merged

[v2] Double-quote Windows alias command args if metacharacters present#10223
hssyoo merged 3 commits intov2from
alias-escape

Conversation

@hssyoo
Copy link
Copy Markdown
Contributor

@hssyoo hssyoo commented Apr 14, 2026

_windows_shell_quote() only escapes for the MSVC C runtime argv parser (backslashes and double quotes) but
does not account for cmd.exe metacharacters. When ExternalAliasCommand passes user-supplied arguments through subprocess.call(command, shell=True), the string is interpreted by cmd.exe before reaching the target process, meaning metacharacters aren't properly escaped.

This PR fixes the issue by double-quoting the alias value string when shell=True and cmd.exe metacharacters are present, automatically treating metacharacters as literals.

Ideally we could collapse _windows_argv_quote and _windows_cmd_shell_quote into a single function, but I'm hesitant to change the code path for other CLI features that use compat_shell_quote, especially features that don't spawn a subprocess with shell=True like ec2-instance-connect ssh.

NOTE: %VAR% expansion and !VAR! delayed expansion cannot be reliably escaped inside double quotes in cmd.exe /c. %% doubling only works in batch file mode. There is no known reliable escape for % or ! inside double quotes on the command line.

Comment thread awscli/compat.py Outdated
ashovlin
ashovlin previously approved these changes Apr 16, 2026
@hssyoo hssyoo merged commit 34be38a into v2 Apr 17, 2026
145 of 148 checks passed
@hssyoo hssyoo deleted the alias-escape branch April 17, 2026 14:46
@hssyoo hssyoo changed the title [v2] Double-quote Windows alias commands [v2] Double-quote Windows alias command args if metacharacters present Apr 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants