Quoting with ssh command with a function call

Question

I need to execute the shell command as follows:

ssh <device> "command"

command is invoked as:

$(typeset); <function_name> \"arguement_string\"; cd ...; ls ... 

How exactly to quote here? Is this correct?

""$(typeset); <function_name> \"arguement_string\""; cd ...; ls ..."

I am confused with this quoting in shell scripts.

Answer 1

I would use a here document:

ssh machine <<'EOF'
hello() {
    echo "hello $1!"
}

hello "world"
EOF

Note that I wrapped the starting EOF in single quotes. Doing so prevents bash from interpreting variables or command substitutions in the local shell.

Answer 2

Don't try to do the quoting by hand -- ask the shell to do it for you!

command_array=( function_name "first argument" "second argument" )
printf -v command_str '%q ' "${command_array[@]}"
ssh_str="$(typeset); $command_str"
ssh machine "$ssh_str"

You can then build up command_array as you wish -- using logic to conditionally append values, with only the kind of quoting you'd usually refer to use to those values, and let printf %q add all additional quoting needed to make the content safe to pass through ssh.

---

If you're trying to incrementally build up a script, you can do that like so:

remote_script="$(typeset)"$'\n'
safe_append_command() {
  local command_str
  printf -v command_str '%q ' "$@"
  remote_script+="$command_str"$'\n'
}

safe_append_command cp "$file" "$destination"
safe_append_command tar -cf /tmp/foo.tar "${destination%/*}"
# ...etc...

ssh machine "$remote_script"

Note that in this case, all expansions take place locally, when the script is being generated, and shell constructs such as redirection operators cannot be used (except by embedding them in a function you then pass to the remote system with typeset). Doing so means that no data passed to safe_append_command can be treated as code -- foreclosing large classes of potential security holes at the cost of flexibility.