Skip to content

fix: quote container paths interpolated into docker exec command lines - #496

Merged
tas50 merged 1 commit into
mainfrom
fix/quote-container-paths
Aug 30, 2026
Merged

fix: quote container paths interpolated into docker exec command lines#496
tas50 merged 1 commit into
mainfrom
fix/quote-container-paths

Conversation

@tas50

@tas50 tas50 commented Aug 30, 2026

Copy link
Copy Markdown
Member

The transport stages every provisioner command as a script under the configured temp_dir and then runs it inside the container. Both halves of that — creating the directory, and running the script — built their docker exec command line by interpolating the path into a string with no quoting, so a temp_dir containing a space was torn apart by the shell before docker ever saw it.

On Linux, create_dir_on_container produced mkdir -p /var/tmp/kitchen docker, which created two directories, neither of them the one asked for; Container::Linux#execute then handed bash /var/tmp/kitchen as the script to run.

On Windows, Container::Windows#execute produced powershell ... -File C:\Users\Foo Bar\Temp\docker-<uuid>.ps1. -File takes exactly one argument, so PowerShell looked for a script named after the first word of the directory. $env:TEMP — the default — contains a space whenever the logged-in user's name does.

The docker cp that puts the script there already escapes both of its paths, and so does the probe that checks the copy landed, so these were the only steps in the sequence that did not.

What changed

  • create_dir_on_container escapes the path it passes to mkdir -p. The PowerShell branch already quotes the path itself and its argument is reassembled by PowerShell rather than split by a shell, so it is left alone.
  • Container::Linux#execute escapes the script path it passes to /bin/bash.
  • Container::Windows#execute quotes the script path it passes to -File.

Escaping is a no-op for a path with no space in it, so nothing changes for a command line that already worked.

Tests

Three regression tests, one per site, asserting on the argument vector the command splits into rather than on the string. All three fail on main:

3 examples, 3 failures

rspec ./spec/container_helper_spec.rb:361 # ...create_dir_on_container keeps a path containing a space as one argument
rspec ./spec/windows_container_spec.rb:103 # ...Windows#execute quotes a script path containing a space
rspec ./spec/linux_container_spec.rb:237 # ...Linux#execute keeps a temp_dir containing a space as one argument

Container::Windows#execute had no tests at all before this, and neither did create_dir_on_container, container_exec or run_container; they are covered here alongside the fix.

Verification

$ bundle exec rake test
378 examples, 0 failures

$ cookstyle --chefstyle          # Cookstyle 9.0.0 / RuboCop 1.90.0
44 files inspected, no offenses detected

The transport stages every provisioner command as a script under the
configured `temp_dir` and then runs it inside the container. Both halves
of that -- creating the directory and running the script -- built their
`docker exec` command line by interpolating the path into a string, with
no quoting, so a `temp_dir` containing a space was torn apart by the
shell before docker ever saw it.

On Linux that meant `mkdir -p /var/tmp/kitchen docker` created two
directories, neither of them the one asked for, and bash was then handed
`/var/tmp/kitchen` as the script to run. On Windows it meant PowerShell's
`-File`, which takes exactly one argument, looked for a script named
after the first word of the directory -- and `$env:TEMP` contains a space
whenever the logged-in user's name does.

The copy that puts the script there already escaped both of its paths, so
this was the one step in the sequence that did not.

Escaping is a no-op for a path without a space, so nothing changes for a
command line that already worked.

Signed-off-by: Tim Smith <tim@mondoo.com>
@tas50
tas50 merged commit ae3a754 into main Aug 30, 2026
107 checks passed
@tas50
tas50 deleted the fix/quote-container-paths branch August 30, 2026 03:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant