terminal: preserve special characters in file names dropped into terminal

src/vs/platform/terminal/common/terminalEnvironment.ts

@@ -7,9 +7,9 @@ import { OperatingSystem, OS } from '../../../base/common/platform.js';
 import { IShellLaunchConfig, TerminalShellType, PosixShellType, WindowsShellType, GeneralShellType } from './terminal.js';
 
 /**
- * Aggressively escape non-windows paths to prepare for being sent to a shell. This will do some
- * escaping inaccurately to be careful about possible script injection via the file path. For
- * example, we're trying to prevent this sort of attack: `/foo/file$(echo evil)`.
+ * Escape non-windows paths to prepare for being sent to a shell. The path is wrapped in
+ * shell-appropriate quotes so that special characters (e.g. `~`, `!`, `$`, `|`, `;`) that
+ * appear in file names are treated as literals and cannot cause shell injection.
  */
 export function escapeNonWindowsPath(path: string, shellType?: TerminalShellType): string {
 	let newPath = path;
@@ -65,10 +65,6 @@ export function escapeNonWindowsPath(path: string, shellType?: TerminalShellType
 			break;
 	}
 
-	// Remove dangerous characters except single and double quotes, which we'll escape properly
-	const bannedChars = /[\`\$\|\&\>\~\#\!\^\*\;\<]/g;
-	newPath = newPath.replace(bannedChars, '');
-
 	// Apply shell-specific escaping based on quote content
 	if (newPath.includes('\'') && newPath.includes('"')) {
 		return escapeConfig.bothQuotes(newPath);

src/vs/platform/terminal/test/common/terminalEnvironment.test.ts

@@ -91,9 +91,15 @@ suite('terminalEnvironment', () => {
 			strictEqual(escapeNonWindowsPath('/foo/bar\'baz'), '\'/foo/bar\\\'baz\'');
 		});
 
-		test('should remove dangerous characters', () => {
-			strictEqual(escapeNonWindowsPath('/foo/bar$(echo evil)', PosixShellType.Bash), '\'/foo/bar(echo evil)\'');
-			strictEqual(escapeNonWindowsPath('/foo/bar`whoami`', PosixShellType.Bash), '\'/foo/barwhoami\'');
+		test('should preserve special characters that are safe inside single quotes', () => {
+			// Characters like $, `, ~, !, #, ^, &, *, |, ;, <, > are all literal inside single quotes
+			// and must be preserved so that file names containing them are passed correctly.
+			strictEqual(escapeNonWindowsPath('/foo/bar$(echo evil)', PosixShellType.Bash), '\'/foo/bar$(echo evil)\'');
+			strictEqual(escapeNonWindowsPath('/foo/bar`whoami`', PosixShellType.Bash), '\'/foo/bar`whoami`\'');
+			strictEqual(escapeNonWindowsPath('/foo/file~name', PosixShellType.Bash), '\'/foo/file~name\'');
+			strictEqual(escapeNonWindowsPath('/foo/file!name', PosixShellType.Bash), '\'/foo/file!name\'');
+			strictEqual(escapeNonWindowsPath('/foo/file#name', PosixShellType.Bash), '\'/foo/file#name\'');
+			strictEqual(escapeNonWindowsPath('/foo/file;name', PosixShellType.Bash), '\'/foo/file;name\'');
 		});
 	});
 });