Skip to content

Fix double-escaped SSH commands#6240

Draft
Copilot wants to merge 6 commits intomainfrom
copilot/fix-double-escaped-ssh-commands
Draft

Fix double-escaped SSH commands#6240
Copilot wants to merge 6 commits intomainfrom
copilot/fix-double-escaped-ssh-commands

Conversation

Copy link
Contributor

Copilot AI commented Feb 12, 2026

SSH commands were escaped twice: once when building the command string in run_ssh_command(), then again when wrapping for shell execution in generate_ssh_command(). This produced unnecessarily complex debug output with nested quote escaping.

Changes

Modified run_ssh_command() to apply selective quoting:

  • Arguments matching [a-zA-Z0-9_=.\/:-]+ are passed unquoted
  • All other arguments (spaces, quotes, shell metacharacters) use escapeshellarg()
  • Removed redundant docker-compose-run special case (now handled uniformly)

The outer escaping in generate_ssh_command() remains unchanged, maintaining the two-layer security model.

Example

Before:

ssh -q 'foo' -t 'wp '\''plugin'\'' '\''list'\'' '\''--debug'\'''

After:

ssh -q 'foo' -t 'wp plugin list --debug'

Arguments with spaces still escape correctly:

ssh -q 'foo' -t 'wp post create '\''--post_title=My Title'\'''

Test Coverage

Added Behat scenario SSH commands should not be double-escaped to verify output format.

Original prompt

This section details on the original issue you should resolve

<issue_title>Double escaped SSH commands</issue_title>
<issue_description>When running a command over SSH (eg. via the --ssh flag or an @-alias), the contents of the command flag appears to be double escaped.

Example:

wp --ssh=foo plugin list --debug

Results in:

Running SSH command: ssh -q 'foo' -t 'wp '\''plugin'\'' '\''list'\'' '\''--debug'\'''

I would expect it to be:

Running SSH command: ssh -q 'foo' -t 'wp plugin list --debug'

The double escaping appears to come from two calls to escapeshellarg, first inside WP_CLI\Runner::run_ssh_command() and secondly within the corresponding condition in WP_CLI\Runner::generate_ssh_command() (and conditions above that for Docker, Vagrant, etc).

Is there a reason for the double escaping that I'm missing?</issue_description>

Comments on the Issue (you are @copilot in this section)

@danielbachhuber > Is there a reason for the double escaping that I'm missing?

Yes: I wrote bad code :) It's worth fixing.</comment_new>
<comment_new>@schlessera

after they are receiving the '

@marksabbath I'm not sure what you mean by that? I don't think we're directly adding quotes anywhere, they are only added by escapeshellarg(). Or am I missing something?</comment_new>


✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Copilot AI and others added 5 commits February 12, 2026 22:59
Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>
…hars

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>
Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>
Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>
Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix double escaped SSH commands in runner Fix double-escaped SSH commands Feb 12, 2026
Copilot AI requested a review from swissspidy February 12, 2026 23:07
@codecov
Copy link

codecov bot commented Feb 13, 2026

Codecov Report

❌ Patch coverage is 85.71429% with 1 line in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
php/WP_CLI/Runner.php 85.71% 1 Missing ⚠️

📢 Thoughts on this report? Let us know!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

command:cli Related to 'cli' command

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Double escaped SSH commands

2 participants