added: shell-escape

server/src/api.rs

@@ -9,6 +9,7 @@ use std::time::SystemTime;
 use anyhow::Context;
 use axum::body;
 use axum::extract::{Query, State};
+use shell_escape::escape;
 use ssh_cert_dist_common::*;
 
 use axum::{http::StatusCode, response::IntoResponse, Json, Router};
@@ -285,14 +286,14 @@ impl From<&Certificate> for CertInfo {
                     format!("{opt}={val}")
                 }
             })
-            .map(|arg| format!("-O {arg}"))
+            .map(|arg| format!("-O {}", escape(arg.into())))
             .collect::<Vec<_>>()
             .join(" ");
         let opts = opts.trim();
         let renew_command = format!(
-            "ssh-keygen -s ./ca_key {host_key} -I {} -n {} -V {validity_days}d {opts}",
-            cert.key_id(),
-            cert.valid_principals().join(",")
+            "ssh-keygen -s ./ca_key {host_key} -I {} -n {} -V {validity_days}d {opts} {}.pub",
+            escape(cert.key_id().into()),
+            escape(cert.valid_principals().join(",").into()), escape(cert.key_id().into())
         );
         CertInfo {
             principals: cert.valid_principals().to_vec(),