Skip to content

Feature option values are changed before install.sh sees them: quotes are stripped, and $… is expanded or executed #1324

Open

Description

Problem

A Feature can receive a different string option value from the one configured in
devcontainer.json. Quotes are removed, $VAR is expanded, $(…) and backticks are executed, and backslashes are consumed. The build still succeeds, so nothing
signals that the value changed.

Repro (devcontainer CLI 0.89.0)

A local Feature with one string option, value, whose install.sh prints it:

#!/bin/sh
printf '%s\n' "$VALUE"
"features": { "./echo-opt": { "value": "say \"hi\" to $HOME as $(id -un)" } }
  • Expected: say "hi" to $HOME as $(id -un)
  • Actual: say hi to /root as root

A value with a space inside quotes, such as A="two words", fails the build instead,
with devcontainer-features.env: line 1: words: not found.

Cause

getFeatureEnvVariables (src/spec-node/containerFeatures.ts) writes each option as
NAME="value" without escaping. The install wrapper then sources the file
(set -a; . ./devcontainer-features.env), so the shell interprets the value. Issue #148
and PR #149 fixed this for spaces, but not for ", $, backticks or \.

Suggested fix

Write each value in single quotes, with ' escaped as '\''. That's what
escapeQuotesForShell already does for the wrapper's Options echo. This changes
behaviour for anyone relying on $ being expanded in option values today.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions