PowerShell Command Injection Fix: Handling Unicode Quotes in Shell Escape

Vulnerability Overview This vulnerability involves command injection in PowerShell via carefully crafted filenames. PowerShell treats multiple Unicode smart quotation marks (U+2018, U+2019, U+201A, U+201B) as single quote delimiters, identical to the ASCII apostrophe. However, existing quote-escaping helper functions only double the ASCII apostrophe. This oversight can cause open quotes around paths and statements when these commands are executed in SSH accounts, thereby leading to command injection. Affected Scope Affected Components: and Specific Functions: and Remediation The fix involves doubling all five delimiters when wrapping PowerShell paths to ensure they are always treated as data. The specific modifications are as follows: 1. Add the variable: 2. Modify the function: 3. Update test cases: ```go func TestShellEscapePowerShell(t *testing.T) { tests := []struct { unescaped, escaped string }{ {"c:\\test\\notepad", "c:\\test\\notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notepad"}, {"c:\\test\\'notepad", "c:\\test\\'notep

Goal Reached Thanks to every supporter — we hit 100%!

PowerShell Command Injection Fix: Handling Unicode Quotes in Shell Escape

More from this source