[Feature Request] Support quoting of command when using "borg create" with "--paths-from-command"

[Mark-Joy]

With borg version 1.2.0b3, It is possible to chain multiple pipes using --paths-from-stdin i.e:

apt-file list bash | sed -Ee 's/^.*: //g' | borg create --show-version --info --progress --stats --list --compression=lz4 --paths-delimiter="\n" --paths-from-stdin ::BashPkg-{now}

A better form would be using --paths-from-command

borg create --show-version --info --progress --stats --list --compression=lz4 --paths-delimiter="\n" --paths-from-command ::BashPkg-{now} -- "apt-file list bash | sed -Ee 's/^.*: //g'"

However, it won't work. I got error:
command "apt-file list bash | sed -Ee 's/^.*: //g'" not found

If I removed the double quote at "apt-file..., then it was borg create command pipe with sed command, not apt-file with sed.

[ThomasWaldmann]

Maybe we directly invoke the command without going via a shell, needs checking...

[ThomasWaldmann]

https://github.com/borgbackup/borg/blob/1.2.0b3/src/borg/archiver.py#L547

there is also borg.helpers.popen_with_error_handling and prepare_subprocess_env(system=True) which could/should be used.

@Mark-Joy do you want to try a PR to improve this?

[ThomasWaldmann]

@Mark-Joy can you try putting "apt-file list bash | sed -Ee 's/^.*: //g'" into a script file and invoke that with --paths-from-command?

executing commands via a shell is nothing borg does yet, it always avoids the shell.

[Mark-Joy]

https://github.com/borgbackup/borg/blob/1.2.0b3/src/borg/archiver.py#L547

I changed the line to:

if len(args.paths) == 1:
    proc = subprocess.Popen(args.paths[0], stdout=subprocess.PIPE, shell=True)
else:
    proc = subprocess.Popen(args.paths, stdout=subprocess.PIPE)

But I guess setting shell=True is not encouraged although there seems to be no risk difference. One thing for sure that I don't know enough in this situation :)

[Gu1nness]

I can do this one.

[ThomasWaldmann]

Well, I guess we need to discuss security implications first, whether borg shall support invoking commands via the shell.

Also, I'ld like to get feedback about this first:
#5968 (comment)