iTunes Connect Transporter chokes on passwords containing shell metacharacters

Originator:irons
Number:rdar://19545375 Date Originated:2015/01/19
Status:Open Resolved:
Product:iTunes Connect Product Version:1.8.3
Classification:Other Bug Reproducible:Always
 
Summary:
iTunes Connect Transporter can’t handle passwords containing, at minimum, | or & characters, even if they’re properly quoted.

Steps to Reproduce:

1. Run this command:

mkdir whatever.itmsp

2. Now run this command:

/Applications/Xcode.app/Contents/Applications/Application\ Loader.app/Contents/MacOS/itms/bin/iTMSTransporter -m verify -u somebody@somewhere.com -p 'smoosh|’ -f whatever.itmsp

Expected Results:
Running `echo $?` to return the exit status of the previously run command should return 0, and iTMSTransporter should complain that whatever.itmsp is empty.

Actual Results:
I get this output:

/Applications/Xcode.app/Contents/Applications/Application Loader.app/Contents/MacOS/itms/bin/../share/iTMSTransporter.woa/iTMSTransporter: line 350: -f: command not found

Instead of 0, the value of $? is 127. 

Notes:

Removing the | or & characters from the password returns the expected error, and a zero return code.

Comments

Extend to include other special chars

I can confirm this error occurs with either % or ( chars as I am having the same issue with itunes transporter

By rob at Aug. 13, 2015, 7:49 a.m. (reply...)

Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!