Terminal mangles names of file dropped into the terminal if they contain quotes

[lgarron]

Type: Bug

1. Create a file named Bram's Hinged Cube v0.2.3.scad
2. Drag and drop the file into the VS Code terminal.

Expected: the file name that is added to the current command prompt is a valid quoted or escaped version of the dropped file.

Observed: the file name is quoted but quotes (any single or double quotes) are stripped. In my case, I get:

'/Users/lgarron/Downloads/Brams Hinged Cube v0.2.3.scad'

In the best case, this results in an immediate error from whatever command the user runs with the mangled file name.

In the worst case, this can refer to a different file and can have mild to catastrophic consequences depending on the assumptions of the user and/or the program they are running.

I've tested this with all extensions disabled on macOS, and it still occurs.

VS Code version: Code 1.100.2 (848b80a, 2025-05-14T21:47:40.416Z)
OS version: Darwin arm64 24.5.0
Modes:

System Info

Item	Value
CPUs	Apple M1 Max (10 x 2400)
GPU Status	2d_canvas: enabled canvas_oop_rasterization: enabled_on direct_rendering_display_compositor: disabled_off_ok gpu_compositing: enabled multiple_raster_threads: enabled_on opengl: enabled_on rasterization: enabled raw_draw: disabled_off_ok skia_graphite: disabled_off video_decode: enabled video_encode: enabled webgl: enabled webgl2: enabled webgpu: enabled webnn: disabled_off
Load (avg)	13, 12, 11
Memory (System)	64.00GB (11.15GB free)
Process Argv	--disable-extensions --crash-reporter-id 88d577d0-2e7d-4290-872a-7cef906b73f7
Screen Reader	no
VM	0%

Extensions disabled

A/B Experiments

vsliv368cf:30146710
vspor879:30202332
vspor708:30202333
vspor363:30204092
vscod805cf:30301675
binariesv615:30325510
c4g48928:30535728
azure-dev_surveyone:30548225
vscrpc:30673769
962ge761:30959799
h48ei257:31000450
pythontbext0:30879054
cppperfnew:31000557
dwnewjupyter:31046869
pythonrstrctxt:31112756
nativeloc1:31192215
5fd0e150:31155592
dwcopilot:31170013
6074i472:31201624
dwoutputs:31242946
customenabled:31248079
hdaa2157:31222309
copilot_t_ci:31222730
e5gg6876:31282496
pythoneinst12:31285622
bgtreat:31268568
4gafe986:31271826
c7cif404:31314491
996jf627:31283433
pythonrdcb7:31303018
usemplatestapi:31297334
0aa6g176:31307128
7bj51361:31289155
747dc170:31275177
pylancecolor:31314202
aj953862:31281341
generatesymbolt:31295002
convertfstringf:31295003
gendocf:31295004

[lgarron]

I've recently also been experiencing issues where template values like file, relativeFile, and fileBasename are also incorrectly quoted when added to the terminal using workbench.action.terminal.sendSequence.

In that case the quotes are unescaped rather than omitted, which is not really any better form a correctness or safety perspective. (If anything, an odd number of unescaped quotes can break the interpretation of all following code, causing a large variety of potential shell syntax issues rather than just an incorrect file name.)

However, this makes me suspect that there is a common cause, and possibly a recent regression.

[lgarron]

This makes me suspect that there is a common cause, and possibly a recent regression.

Unfortunately, I tried https://github.com/microsoft/vscode-bisect and reproduced the issue with dropping files back to 1.95. The bisect tool fails to work on any older builds.

[Sublimeful]

Hey, first time contributor here. I found the lines of code that strips the quotes here:

vscode/src/vs/platform/terminal/common/terminalEnvironment.ts

Lines 19 to 20 in f3d66ce

	const bannedChars = /[\`\$\|\&\>\~\#\!\^\*\;\<\"\']/g;
	newPath = newPath.replace(bannedChars, '');

The comment states that these lines are written to prevent a possible script injection. So, I believe that a decision needs to be made on whether this protection is worth the convenience cost or not.

[meganrogge]

Hey, thanks for reminding me and investigating. I think it's not worth that risk, so will close this.