From 59d95cfd4086224ea46a5c2500a8242e76b89c20 Mon Sep 17 00:00:00 2001
From: Theo Technicguy <19630890+TheoTechnicguy@users.noreply.github.com>
Date: Mon, 28 Oct 2024 14:31:12 +0100
Subject: [PATCH] feat: insert `--` between RSH and rsync commands

Nowadays, CLI program options not always support single-dash syntax and
do not require flags to be set before positional arguments. To ensure
that future remote shells do not interpret rsync flags, this commit
inserts a double dash (`--`) before the transmitted rsync command.
---
 main.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/main.c b/main.c
index 0c60b86d1..994eed170 100644
--- a/main.c
+++ b/main.c
@@ -586,6 +586,10 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char **remote_argv, in
 		args[argc++] = machine;
 #endif
 
+		// include a `--` before any rsync commands to indicate that
+		// all following arguments are intended as positional
+		// and should not be parsed by the shell
+		args[argc++] = "--";
 		args[argc++] = rsync_path;
 
 		if (blocking_io < 0 && (strcmp(t, "rsh") == 0 || strcmp(t, "remsh") == 0))