rapid7/metasploit-framework — pull request #386 by jlee-r7 (2012-05-13 21:31:53+00:00)
Title: Fix posix execute

In posix, a command like `echo 'foo bar'` would previously get parsed
out into arguments for execve like `[ "echo", "'foo", "bar'" ]` which
obviously isn't what you want. After this commit, it sticks the whole
thing in an arg to sh so the execve call ends up looking like (strace output)
`execve("/bin/sh", ["sh", "-c", "echo 'foo bar'"], [/* 26 vars */]) = 0`
This is still a little less than ideal because shell escapes become a
problem; fortunately, that's easy to deal with on the client side as
long as module developers take it into account.