From 7a731fc36e9559713666b92a357b09aa4962de76 Mon Sep 17 00:00:00 2001 From: dtzp555 Date: Sat, 9 May 2026 00:43:45 +1000 Subject: [PATCH] fix(ocp-cli): replace eval-curl with bash array to preserve JSON body quoting MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `eval curl "$_AUTH_HEADER" "$@"` re-tokenizes its argument list according to bash word-splitting rules. When OCP_ADMIN_KEY is set, the JSON body `'{"name": "laptop"}'` (which contains a space) gets split into `'{name:'` and `'laptop}'` — two separate args — so curl receives a malformed body and the server rejects the request. Fix: replace the `_AUTH_HEADER` string + `eval` pattern with a bash array `_AUTH_ARGS`. Array expansion via `"${_AUTH_ARGS[@]}"` preserves word boundaries across substitution with no eval required. Both code paths (OCP_ADMIN_KEY env var and ~/.ocp/admin-key file fallback) and the empty case (no admin key) are preserved unchanged. Verified via `bash -x` trace: Before: `curl … -d '{name:' 'laptop}'` (body split, malformed) After: `curl … -d '{"name": "testkey-pr-c"}'` (body intact, single arg) Identified during fresh-state Round 2 testing on MacBook. Co-Authored-By: Claude Sonnet 4.6 --- ocp | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/ocp b/ocp index e652324..b1e0309 100755 --- a/ocp +++ b/ocp @@ -8,21 +8,18 @@ set -euo pipefail PROXY="http://127.0.0.1:3456" -# Auth header for multi-key mode: reads from OCP_ADMIN_KEY env or ~/.ocp/admin-key file -_AUTH_HEADER="" +# Auth args for multi-key mode: reads from OCP_ADMIN_KEY env or ~/.ocp/admin-key file +# Using a bash array preserves word boundaries — no eval needed. +_AUTH_ARGS=() if [[ -n "${OCP_ADMIN_KEY:-}" ]]; then - _AUTH_HEADER="-H \"Authorization: Bearer $OCP_ADMIN_KEY\"" + _AUTH_ARGS=(-H "Authorization: Bearer $OCP_ADMIN_KEY") elif [[ -f "$HOME/.ocp/admin-key" ]]; then - _AUTH_HEADER="-H \"Authorization: Bearer $(cat "$HOME/.ocp/admin-key")\"" + _AUTH_ARGS=(-H "Authorization: Bearer $(cat "$HOME/.ocp/admin-key")") fi # Wrapper: curl with optional auth _curl() { - if [[ -n "$_AUTH_HEADER" ]]; then - eval curl "$_AUTH_HEADER" "$@" - else - curl "$@" - fi + curl "${_AUTH_ARGS[@]}" "$@" } _json() { python3 -m json.tool 2>/dev/null || cat; }