[Bug 4017] New: ssh -G prints percent-expanded values without escaping %, so re-reading its output expands them a second time
bugzilla-daemon at mindrot.org
bugzilla-daemon at mindrot.org
Thu Oct 8 14:01:11 AEDT 2026
https://bugzilla.mindrot.org/show_bug.cgi?id=4017
Bug ID: 4017
Summary: ssh -G prints percent-expanded values without escaping
%, so re-reading its output expands them a second time
Product: Portable OpenSSH
Version: 10.5p1
Hardware: Other
OS: Linux
Status: NEW
Severity: major
Priority: P5
Component: ssh
Assignee: unassigned-bugs at mindrot.org
Reporter: khush2792001 at gmail.com
`ssh -G` prints the values of `ControlPath`, `IdentityAgent`,
`UserKnownHostsFile`, `RemoteCommand` and the other
percent-expanded options after expansion, but a `%` that was written as
`%%` is printed as a single `%`. Reading the
dump back expands it again:
```
$ ssh -G -o 'ControlPath=/tmp/%%d' host | grep ^controlpath
controlpath /tmp/%d
$ ssh -G -o 'ControlPath=/tmp/%%d' host > d1; ssh -G -F d1 host | grep
^controlpath
controlpath /tmp//root <- %d expanded on the
second read
$ ssh -G -o 'RemoteCommand=echo 100%%' host > d1; ssh -G -F d1 host
vdollar_percent_expand: invalid format
percent_expand: failed
```
regress/sshcfgparse.sh expects `ssh -G` output to reproduce itself.
Writing `%` back as `%%` in
`dump_client_config()` (readconf.c) for the options that are
percent-expanded would restore that.
--
You are receiving this mail because:
You are watching the assignee of the bug.
More information about the openssh-bugs
mailing list