Given:

echo '\\\x41'

bash and other POSIX-compliant shells pass the contents through unmangled:

\\\x41

but zsh parses both \\ and \x41, producing:

\A

This does not render shell-escape's escaping insecure, because zsh doesn't allow escaping the closing single quote – i.e. '\' is valid and produces a backslash. However, it does render it incorrect in some cases. For maximum compatibility, it would be best if shell-escape treated \ similarly to ' and !.

Hi,

Great piece of work. However I face issues using it on Windows. It forces me to go through UTF-8 String, but Windows uses UTF-16 UCS2 strings. So it's incompatible in a way with the platform.

The UNIX implementation only escapes the following characters:

const SHELL_SPECIAL: &'static str = r#" \$'"`!"#;

It should escape at least the following characters (and possibly others):

const SHELL_SPECIAL: &'static str = "|&;<>()$`\\\"' \t\n*?[#~=%!{}";

• switch to double quotes instead of single quotes to solve #6 (?)
• use $'\n' to escape newline and other control characters (this works for bash, so maybe escape() should take an argument like Shell::Bash)
• add surrounding quotes only if the argument contains spaces
  • to create a nicer output that is also displayable to the user
  • if there is a choice the user should maybe also be able to choose which quotes he prefers, like: escape(…, Shell::Bash(Quotes::Single))

I just wanted to leave those ideas here as a note. Maybe I implement them sometime in the future (maybe not).