Chromium start-up script doesn't accept argument values with spaces in $CHROMIUM_FLAGS, cause is lack of quotes

Bug #1514484 reported by Iuri Chaer on 2015-11-09
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
chromium-browser (Ubuntu)
Medium
Unassigned

Bug Description

You can't have arguments with spaces inside CHROMIUM_FLAGS, whatever comes after the first space is going to be interpreted as an URL by the actual chromium binary. Easy repro:

1. Set user's CHROMIUM_FLAGS with an argument containing spaces, eg:
$ echo 'CHROMIUM_FLAGS=--user-agent="A B C"' > .chromium-browser.init

2. Run chromium:
$ /usr/bin/chromium-browser

3. See 2 extra open tabs, one trying to open URL 'B', the other 'C'.

The cause for this funny behavior is the lack of quotes around $CHROMIUM_FLAGS in the script installed in /usr/bin/chromium-browser -- it calls $LIBDIR/$APPNAME $CHROMIUM_FLAGS "$@" by the end of the script. I've tried working around it but couldn't, no amount of escaping and extra quotes seems to help if it's called like that.

The attachment "Patch adding quotes to /usr/bin/chromium-browser" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

tags: added: patch
Chad Miller (cmiller) wrote :

I don' think this patch does what you expect.

Try with more than one value in the variable.

CHROMIUM_FLAGS='--user-data-dir=/tmp/cr --user-agent="A B C"'

Changed in chromium-browser (Ubuntu):
assignee: nobody → Chad Miller (cmiller)
status: New → Confirmed
Iuri Chaer (iuri-chaer) wrote :

I noticed that last night =( so sad how often I seem to be surprised by how shell expansion works.

Best I could come up with was transform CHROMIUM_FLAGS into an array and use "${CHROMIUM_FLAGS[@]}" in the calls instead. Sorry for the failed patch attempt.

I agree that it's tricky.

The two solutions I can think of is your idea of an array, and assumption
that the variable should go through two levels of interpretation.

The way that makes current scripts and files still work is the latter. It
would go like this:

If there is a special character in the output, it must be quoted or
escaped. Then, special characters must be escaped again.

So, instead of

CHROMIUM_FLAGS="--foo --bar=one\ two"

it would be

CHROMIUM_FLAGS="--foo --bar=one\\\ two"

So, you should be able to

CHROMIUM_FLAGS="--user-agent=Mozilla\\\ 9.0\\\ not\\\ really
--user-data-dir=/path/with/a\\\ space"

On first interpretation, those backslash-character values are interpreted:
backslashbackslash becomes a backslash, and backslashspace becomes a space.

On second interpretation, the one that runs the program, backslashspace is
a space, but not a space that separates parameters. A literal space.

It's not pretty, I know.

On Tue, Nov 10, 2015 at 8:59 AM, Iuri Chaer <email address hidden> wrote:

> I noticed that last night =( so sad how often I seem to be surprised by
> how shell expansion works.
>
> Best I could come up with was transform CHROMIUM_FLAGS into an array and
> use "${CHROMIUM_FLAGS[@]}" in the calls instead. Sorry for the failed
> patch attempt.
>
> --
> You received this bug notification because you are a bug assignee.
> https://bugs.launchpad.net/bugs/1514484
>
> Title:
> Chromium start-up script doesn't accept argument values with spaces in
> $CHROMIUM_FLAGS, cause is lack of quotes
>
> Status in chromium-browser package in Ubuntu:
> Confirmed
>
> Bug description:
> You can't have arguments with spaces inside CHROMIUM_FLAGS, whatever
> comes after the first space is going to be interpreted as an URL by
> the actual chromium binary. Easy repro:
>
> 1. Set user's CHROMIUM_FLAGS with an argument containing spaces, eg:
> $ echo 'CHROMIUM_FLAGS=--user-agent="A B C"' > .chromium-browser.init
>
> 2. Run chromium:
> $ /usr/bin/chromium-browser
>
> 3. See 2 extra open tabs, one trying to open URL 'B', the other 'C'.
>
> The cause for this funny behavior is the lack of quotes around
> $CHROMIUM_FLAGS in the script installed in /usr/bin/chromium-browser
> -- it calls $LIBDIR/$APPNAME $CHROMIUM_FLAGS "$@" by the end of the
> script. I've tried working around it but couldn't, no amount of
> escaping and extra quotes seems to help if it's called like that.
>
> To manage notifications about this bug go to:
>
> https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+bug/1514484/+subscriptions
>

Iuri Chaer (iuri-chaer) wrote :

Uh, I've tried that, but it keeps splitting the argument values no matter how many slashes I add (they end up interpreted as part of the URL -- for instance, instead of "B" chromium gives me "B/" in the address bar). I've been trying to understand what bash is doing, but it's really eluding me.

Miyuki Taniguchi (miyuki) wrote :

 Space characters in chromium flags seem to be always parsed even if they are escaped. (Of course, it must be a bug.)

 When splitting all flags in $CHROMIUM_FLAGS by newline and running chromium after IFS=$'\n' , it works.
(And do not escape spaces. like --user-agent=foo bar , not --user-agent="foo bar" or --user-agent=foo\ bar .)

Olivier Tilloy (osomon) on 2017-04-26
Changed in chromium-browser (Ubuntu):
importance: Undecided → Medium
Olivier Tilloy (osomon) on 2018-03-09
Changed in chromium-browser (Ubuntu):
assignee: Chad Miller (cmiller) → nobody
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers