bug#59817: [PATCH] Fix etags local command injection vulnerability

[Francesco Potortì]

>I don't understand why you need an extra pair of quotes in the expanded
>string.
>
>  $ echo \''hello; world'
>  'hello; world
>
>As you see, the semi-colon was successfully hidden from the shell.
>
>What am I missing?

That only works at the beginning or end of a string.  In general, inside a 
single-quoted string, single quotes are not allowed.  So, to include a single 
quote inside a single-quoted string, you have to:
- close the quoted string using '
- put a literal single quote usign \'
- reopen the quoted string using '

If you want to avoid checking for the special cases of a stray single string at 
beginning or end of the original string, you just quote everything qith a 
single quote at beginning and end, and then substitute each ' with '\''.