Escape characters

[yasire]

I’m using Googles csfde tool to enable FileVault via a Applescipt project that does other things as well. I just realized that if a user’s password contains unfriendly characters, the csfde tool will fail as they need to be escaped. Putting the password in quotes doesn’t help so I need to escape the characters.

My thought is to go through the password by character. If it is in a list {?/"!..} then first put in the backslash to build a modified password. Does that sound like a fair plan or is there an easier way to do this task?
thanks
Todd

[DJ_Bazzie_Wazzie]

Do you use it on the CLI? If so, did you used quoted form of?

[yasire]

Yes I used quoted form with no success. I also tried “"” & password & “"”

It is done via ‘do shell script’ command.

[DJ_Bazzie_Wazzie]

@cauliflowervest

An undocumented feature is that if the password argument is supplied value “-”, then the real password will be expected on stdin to csfde. Note that this feature is meant only to be used with scripts that write the password directly into stdin. It is not secure for direct interaction with a user because no tty modifications are made to not echo the password to the screen. The point of this feature is only to avoid having passwords visible on process list tables while csfde runs.

Have you tried this?

do shell script "/bin/echo -n " & quoted form of password & " | csfde <disk_bsd_name> <username> -"

I know the document says that it is for security reasons but you never know. I don’t have cauliflowervest installed. the CLI handles the quotations, not the process, and is responsible that the process receives the correct/complete arguments. So quotation or escaping should give the same results; The arguments that are given to the process are identical. Quotation in a shell doesn’t work like strings in programming languages, wrapping quotes around isn’t correct. A quote in the shell turns substitution on or off so when you have a string like

“hello world!”

You can write in the shell down as

“hello world!”
‘hello world!’
hello’ 'world!"
hello\ world!

As you can see there are many different ways. The first is still partly with substitution while the second is completely without substitution. The third only turns substitution off for the space character and the second quote turns substitution on again. The last one escapes a single character with substitution fully on.

What we want, especially with string that contains special characters, is to turn substitution off completely. To achieve that we have to go for the second method. But the second method is built in AS so what you need in AS is only

quoted form of "hello world!"

[yasire]

Thank you for the through write-up. Using your suggestions, I was able to solve the problem. While the nifty echo trick didn’t work, I used single quotes instead of double quotes. Thank you again for your help!
Yas