Fix dollarQuote state management in shellwords.go

scumfrog · scumfrog · commit e2951fc82d97 · 2026-04-13T17:35:30.000+02:00
Updated dollarQuote handling to prevent toggling on bare ')' characters.
diff --git a/shellwords.go b/shellwords.go
@@ -200,23 +200,50 @@ loop:
 				backtick = ""
 				backQuote = !backQuote
 			}
+
 		case ')':
 			if !singleQuoted && !doubleQuoted && !backQuote {
 				if p.ParseBacktick {
-					if dollarQuote {
-						out, err := shellRun(backtick, p.Dir)
-						if err != nil {
-							return nil, err
-						}
-						buf = buf[:len(buf)-len(backtick)-2] + out
+					// Hardened fix:
+					// A bare ')' must never open dollarQuote state.
+					// Only close an already-open $(...) region.
+					if !dollarQuote {
+						buf += string(r)
+						got = argSingle
+						continue
+					}
+
+					out, err := shellRun(backtick, p.Dir)
+					if err != nil {
+						return nil, err
+					}
+
+					// Defensive guard: valid $(...) implies the buffer must contain
+					// the "$(" prefix plus the collected command body.
+					if len(buf) < len(backtick)+2 {
+						return nil, errors.New("invalid command line string")
 					}
+
+					buf = buf[:len(buf)-len(backtick)-2] + out
 					backtick = ""
-					dollarQuote = !dollarQuote
+					dollarQuote = false
 					continue
 				}
+
+				// Default mode:
+				// Do not toggle dollarQuote on a bare ')'.
+				// Treat it as a literal character.
+				if !dollarQuote {
+					buf += string(r)
+					got = argSingle
+					continue
+				}
+
 				backtick = ""
-				dollarQuote = !dollarQuote
+				dollarQuote = false
+				continue
 			}
+
 		case '(':
 			if !singleQuoted && !doubleQuoted && !backQuote {
 				if !dollarQuote && strings.HasSuffix(buf, "$") {
@@ -227,6 +254,7 @@ loop:
 					return nil, errors.New("invalid command line string")
 				}
 			}
+
 		case '"':
 			if !singleQuoted && !dollarQuote {
 				if doubleQuoted {
@@ -235,6 +263,7 @@ loop:
 				doubleQuoted = !doubleQuoted
 				continue
 			}
+
 		case '\'':
 			if !doubleQuoted && !dollarQuote {
 				if singleQuoted {
@@ -243,6 +272,7 @@ loop:
 				singleQuoted = !singleQuoted
 				continue
 			}
+
 		case ';', '&', '|', '<', '>':
 			if !(escaped || singleQuoted || doubleQuoted || backQuote || dollarQuote) {
 				if r == '>' && len(buf) > 0 {
