Skip to content

create-new-feature.sh: xargs-based trimming breaks descriptions containing apostrophes or quotes #2339

@phantom-suzuki

Description

@phantom-suzuki

Summary

.specify/scripts/bash/create-new-feature.sh (as shipped in spec-kit v0.8.0 templates, observed via specify init) uses xargs to strip surrounding whitespace from the positional FEATURE_DESCRIPTION argument:

# around line 87
FEATURE_DESCRIPTION=$(echo "$FEATURE_DESCRIPTION" | xargs)

Because xargs re-parses its stdin as shell-like tokens, any input containing a single quote ('), double quote ("), or backslash (\) aborts immediately with:

xargs: unterminated quote

and the script exits before creating the branch or spec directory.

Reproduction

# from a spec-kit initialized project
bash .specify/scripts/bash/create-new-feature.sh --dry-run "Add user's profile page"
# → xargs: unterminated quote

Natural-language descriptions frequently include apostrophes (user's, can't, etc.), so this is easy to trigger in normal usage.

Expected

The trim step should only strip leading/trailing whitespace, not re-interpret the input as shell tokens.

Suggested fix

Replace the xargs call with a quote-safe whitespace trim. A few options:

# bash parameter expansion (no subshell)
FEATURE_DESCRIPTION="${FEATURE_DESCRIPTION#"${FEATURE_DESCRIPTION%%[![:space:]]*}"}"
FEATURE_DESCRIPTION="${FEATURE_DESCRIPTION%"${FEATURE_DESCRIPTION##*[![:space:]]}"}"

# or: sed-based trim
FEATURE_DESCRIPTION=$(echo "$FEATURE_DESCRIPTION" | sed -E 's/^[[:space:]]+|[[:space:]]+$//g')

# or: awk-based trim
FEATURE_DESCRIPTION=$(echo "$FEATURE_DESCRIPTION" | awk '{$1=$1;print}')

All three preserve input content verbatim regardless of quoting.

Environment

  • spec-kit template version: v0.8.0
  • specify-cli version: 0.8.1.dev0
  • Shell: bash / zsh (both reproduce)
  • OS: macOS (should also reproduce on Linux since xargs behavior is POSIX-ish)

Context

Found during a scaffold migration from v0.0.22 → v0.8.0 (older template layout). The regression was flagged by an automated code review on the downstream migration PR.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions