rsync 3.1.3-8ubuntu0.5 (CVE-2022-29154 patch) breaks remote brace interpretation

[Alan Rosenthal]

Commands like this:
        rsync -a host.example.org:\{this,that} .
have worked for decades, in multiple Ubuntu versions, but were broken by the rsync 3.1.3-8ubuntu0 update (on the client, i.e. the machine on which I type that command).

(To be clear, the backslash there quotes the '{' so that it is sent to the remote rsync rather than being interpreted by the local shell.)

("What happens instead?" It now says "rsync: link_stat "/home/flaps/{this,that}" failed: No such file or directory (2)".)

[Marc Deslauriers (mdeslaur)]

Hi,

The security fix for CVE-2022-29154 unfortunately changed the way arguments are handled.

Could you try adding --old-args ? That should restore the previous behaviour you are expecting.

[Alan Rosenthal (flaps)]

> Could you try adding --old-args ? That should restore the previous behaviour you are expecting.

It does indeed. Thanks for the reply!

[Marc Deslauriers (mdeslaur)]

I am closing this bug, since the new behaviour is expected with the security fix. Thanks!