CLI: '?' inside a quoted value triggers completion help instead of inserting a literal question mark
In progress, NormalPublic
Actions

Assigned To

Authored By

	bradkollmyer
	Jul 11 2026, 12:14 AM

Description

Summary

In both operational and configuration mode, the ? key is a raw readline binding (bind '"?": possible-completions' in vyatta-op/etc/bash_completion.d/vyatta-op). Readline intercepts the keystroke before bash parsing begins, so a literal ? can never be typed into a value. Quoting does not protect it, because quote context does not exist at the readline layer.

The result is silent corruption: the CLI accepts the command, commit succeeds, and the stored value is simply missing the ?, with the surrounding text joined together. No error is raised at any stage and the resulting value looks plausible.

Steps to reproduce

configure
set firewall group remote-group TEST url 'https://api.example.com/v2/blacklist?ipVersion=4&key=SECRET'
show firewall group remote-group TEST url

Actual: the completion-help popup fires at the ?, and the stored value is https://api.example.com/v2/blacklistipVersion=4&key=SECRET.
Expected: a ? typed inside a quoted string is inserted literally.

Impact

Affects every node that takes a URL or free-form string value: firewall group remote-group <name> url, commit-archive locations, image update URLs, etc. Increasingly relevant since remote-group (T5493) encourages URLs that carry API keys as query parameters: a mangled key can mean a silently empty blocklist, i.e. a firewall that looks configured but enforces nothing. Diagnosis is further complicated because vyos-domain-resolver deliberately redacts the query string in its error logs (T8829), hiding the corrupted URL.

Workaround

Ctrl-V then ? (readline quoted-insert). Pasting also works where bracketed-paste is active.

Proposed fix

PR to follow against vyatta-op: rebind ? to a bind -x handler that scans the line left of the cursor for open single/double quotes or a pending backslash escape. Inside a quote/escape it self-inserts; otherwise it triggers the standard help via a DSR round-trip (printf '\e[5n', with the terminal's \e[0n reply bound to possible-completions), so the help path and output remain the stock readline behavior.

Known limitation: on a terminal that does not answer DSR (a VT100 feature supported by all common terminal emulators), ?-help would not fire; Ctrl-V and TAB completion are unaffected either way.

The patch has been tested on VyOS 2026.07.10-1446-rolling: a quoted URL containing ? and & is stored intact, and ?-help continues to work outside quotes.

T2072 (completion vs quoted values), T3410 (unsafe special-character processing in completion), T1848 (special characters in node values, umbrella)