Re: [PATCH] Add shell-quasiquote.

[Random832]

address@hidden (Taylan Ulrich "Bayırlı/Kammer") writes:
> It was not criticism of shell-quote-argument (those are separate).
> Indeed it quotes arguments.  My variant also quotes things that may be
> the name of the command and not an argument.

But why does it *need* to?

Do you realize that you are now suggesting an injection scenario whereby
the attacker is _legitimately_ permitted to supply an arbitrary string
for an ordinary command to be executed, but somehow letting them execute
"if" [which will be a syntax error anyway since they can't supply the
then/fi as separate statements] becomes a security hole?