Correctly escaping command quotes

VERSION

@@ -1 +1 @@
-2019.10.15
+2019.11.19

container_shell/lib/dockage.py

@@ -132,7 +132,8 @@ def container_command(username, user_uid, user_gid, create_user, command, runuse
     # the user, which is a safer default should a sys admin typo the config.
     if create_user.lower() != 'false':
         if command:
-            run_user = "{0} {1} -c \"{2}\"".format(runuser, username, command)
+            run_user = "{0} {1} -c \"{2}\"".format(runuser, username,
+                                                   command.replace("'", "\'").replace('"', '\"'))
         else:
             # if not a specific command, treat this as a login shell
             run_user = '{0} {1} -l {2}'.format(runuser, username, command)

tests/test_dockage.py

@@ -145,6 +145,38 @@ def test_no_create_command(self):
 
         self.assertEqual(cmd, expected)
 
+    def test_escape_single_quotes(self):
+        """
+        ``dockage`` 'container_command' escapes single quotes when supplied
+        with a command to execute
+        """
+        cmd = dockage.container_command(username='liz',
+                                        user_uid=9001,
+                                        user_gid=9001,
+                                        create_user='true',
+                                        command="exec sh -c 'cd ; umask 077 ; mkdir -p .ssh'",
+                                        runuser='/sbin/runuser',
+                                        useradd='/sbin/adduser')
+        expected = "/bin/bash -c \'/usr/sbin/groupadd --gid 9001 liz && /sbin/adduser -m --uid 9001 --gid 9001 -s /bin/bash liz 2>/dev/null && chown liz:liz /dev/pts/0 2>/dev/null ; cd /home/liz 2>/dev/null ; /sbin/runuser liz -c \"exec sh -c \'cd ; umask 077 ; mkdir -p .ssh\'\"\'"
+
+        self.assertEqual(cmd, expected)
+
+    def test_escape_double_quotes(self):
+        """
+        ``dockage`` 'container_command' escapes double quotes when supplied
+        with a command to execute
+        """
+        cmd = dockage.container_command(username='liz',
+                                        user_uid=9001,
+                                        user_gid=9001,
+                                        create_user='true',
+                                        command='exec sh -c "cd ; umask 077 ; mkdir -p .ssh"',
+                                        runuser='/sbin/runuser',
+                                        useradd='/sbin/adduser')
+        expected = '/bin/bash -c \'/usr/sbin/groupadd --gid 9001 liz && /sbin/adduser -m --uid 9001 --gid 9001 -s /bin/bash liz 2>/dev/null && chown liz:liz /dev/pts/0 2>/dev/null ; cd /home/liz 2>/dev/null ; /sbin/runuser liz -c "exec sh -c "cd ; umask 077 ; mkdir -p .ssh""\''
+
+        self.assertEqual(cmd, expected)
+
 
 class TestGenerateName(unittest.TestCase):
     """A suite of test cases for the ``generate_name`` function"""