ansible/ansible — pull request #6201 by cchurch (2014-02-27 04:04:33+00:00)
Title: Escape subversion parameters for running svn commands

The subversion module breaks when its parameters contain single quotes. In particular, you cannot use a password that contains any number of single quote (`'`) characters.

Due to the way the svn command line arguments are assembled, it is also possible to run arbitrary commands by setting certain parameters to carefully crafted strings (e.g. `username="'; rm -rf /"`).

This patch passes all svn arguments as a list of strings to allow subprocess.Popen to escape them properly and adds an integration test to verify single quotes are handled correctly.