fix(WebServer): only quote --path argument when path contains spaces

Author: FASTSHIFT

Tools/WebServer/core/file_transfer.py

@@ -28,10 +28,10 @@ def _sanitize_path(path: str) -> str:
 
 
 def _format_path_arg(path: str) -> str:
-    """Format path argument for command line, quoting only if needed."""
-    if len(path) == 1:
-        return path
-    return f'"{path}"'
+    """Format path argument for command line, quoting only if path contains spaces."""
+    if " " in path:
+        return f'"{path}"'
+    return path
 
 
 class FileTransfer:

Tools/WebServer/tests/test_file_transfer.py

@@ -394,7 +394,7 @@ def test_frename_success(self):
         success, msg = self.ft.frename("/old.txt", "/new.txt")
         self.assertTrue(success)
         self.mock_fpb.send_fl_cmd.assert_called_with(
-            'fl -c frename --path "/old.txt" --newpath "/new.txt"',
+            "fl -c frename --path /old.txt --newpath /new.txt",
             timeout=2.0,
             max_retries=3,
         )
@@ -1496,21 +1496,27 @@ def test_path_with_carriage_return_rejected(self):
         self.assertIn("control characters", str(ctx.exception))
 
     def test_path_with_quotes_escaped(self):
-        """Test path with quotes is properly escaped."""
+        """Test path with quotes is escaped by sanitize, no wrapping without spaces."""
         ft = FileTransfer(self.mock_fpb)
         ft.flist('/path/with"quotes"')
         call_args = self.mock_fpb.send_fl_cmd.call_args[0][0]
-        # Verify quotes are escaped
-        self.assertIn('\\"', call_args)
-        # Verify the path is properly quoted
-        self.assertIn('--path "/path/with', call_args)
+        # _sanitize_path escapes " to \", no spaces → no wrapping quotes
+        self.assertIn('--path /path/with\\"quotes\\"', call_args)
+
+    def test_path_with_quotes_and_spaces_escaped(self):
+        """Test path with both quotes and spaces is properly escaped and quoted."""
+        ft = FileTransfer(self.mock_fpb)
+        ft.flist('/path/with "quotes"')
+        call_args = self.mock_fpb.send_fl_cmd.call_args[0][0]
+        # _sanitize_path escapes " to \", then _format_path_arg wraps in quotes due to space
+        self.assertIn('--path "/path/with \\"quotes\\""', call_args)
 
     def test_normal_path_unchanged(self):
-        """Test normal path works correctly."""
+        """Test normal path works correctly without quotes."""
         ft = FileTransfer(self.mock_fpb)
         ft.fopen("/normal/path/file.txt", "r")
         call_args = self.mock_fpb.send_fl_cmd.call_args[0][0]
-        self.assertIn('"/normal/path/file.txt"', call_args)
+        self.assertIn("--path /normal/path/file.txt", call_args)
 
     def test_fmkdir_sanitizes_path(self):
         """Test fmkdir sanitizes path."""

Tools/WebServer/tests/test_file_transfer_spaces.py

@@ -178,12 +178,12 @@ def test_fopen_single_char_path_no_quotes(self):
             max_retries=3,
         )
 
-    def test_multi_char_path_has_quotes(self):
-        """Test that multi-char paths still have quotes."""
+    def test_multi_char_path_no_quotes_without_spaces(self):
+        """Test that multi-char paths without spaces have no quotes."""
         success, msg = self.ft.fopen("/a", "r")
         self.assertTrue(success)
         self.mock_fpb.send_fl_cmd.assert_called_with(
-            'fl -c fopen --path "/a" --mode r',
+            "fl -c fopen --path /a --mode r",
             timeout=2.0,
             max_retries=3,
         )