[MSHARED-431] # (Hash-Sign) should trigger quoting in BourneShell.java

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: maven-shared-utils-0.8
• Fix Version/s: maven-shared-utils-3.3.3
• Component/s: maven-shared-utils
• Environment: Unix (Linux)
• Assignee: Sylwester Lachiewicz
• Reporter: Fritz Elfert
• Created: 03/Aug/15 13:22
• Updated: 03/Feb/21 15:05
• Resolved: 20/Jul/20 12:49

Description

When trying to use the latest maven-jarsign-plugin using a keystore-password which started with a hash (#), signing failed. After enabling debug output with -X, I got a strange debug message:

[DEBUG] Option lacks argument

Since signtool is invoked using /bin/sh -c ..., of course, any # must be quoted, because otherwise it acts as a comment-start and thus effectively cuts-off the rest of the cmdline.
After single-quoting the password in the pom.xml, the jar signing was ok.

=>
Adding '#' to BASH_QUOTING_TRIGGER_CHARS in org.apache.maven.shared.utils.cli.shell.BourneShell.java should fix the problem.

Issue Links

• is cloned by: MSHARED-851 & must trigger quoting in Windows
• is related to: MSHARED-297 Commandline class shell injection vulnerabilities