[Bug 4017] New: ssh -G prints percent-expanded values without escaping %, so re-reading its output expands them a second time

bugzilla-daemon at mindrot.org bugzilla-daemon at mindrot.org
Thu Oct 8 14:01:11 AEDT 2026


https://bugzilla.mindrot.org/show_bug.cgi?id=4017

            Bug ID: 4017
           Summary: ssh -G prints percent-expanded values without escaping
                    %, so re-reading its output expands them a second time
           Product: Portable OpenSSH
           Version: 10.5p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: major
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: khush2792001 at gmail.com

`ssh -G` prints the values of `ControlPath`, `IdentityAgent`,
`UserKnownHostsFile`, `RemoteCommand` and the other
percent-expanded options after expansion, but a `%` that was written as
`%%` is printed as a single `%`. Reading the
dump back expands it again:

```
$ ssh -G -o 'ControlPath=/tmp/%%d' host | grep ^controlpath
controlpath /tmp/%d
$ ssh -G -o 'ControlPath=/tmp/%%d' host > d1; ssh -G -F d1 host | grep
^controlpath
controlpath /tmp//root                      <- %d expanded on the
second read
$ ssh -G -o 'RemoteCommand=echo 100%%' host > d1; ssh -G -F d1 host
vdollar_percent_expand: invalid format
percent_expand: failed
```

regress/sshcfgparse.sh expects `ssh -G` output to reproduce itself.
Writing `%` back as `%%` in
`dump_client_config()` (readconf.c) for the options that are
percent-expanded would restore that.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.


More information about the openssh-bugs mailing list