From dff80bbcd953b1bbfcddea598ce513cfc66eb51c Mon Sep 17 00:00:00 2001
From: Josh Gustafson <j@gustafson.me>
Date: Mon, 2 Mar 2026 09:06:01 -0700
Subject: [PATCH] Escape ZFS args

---
 lib/types/zfs_fs.nix     | 12 +++++++-----
 lib/types/zfs_volume.nix |  6 +++++-
 lib/types/zpool.nix      | 12 ++++++++++--
 3 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/lib/types/zfs_fs.nix b/lib/types/zfs_fs.nix
index e006432..3635e8e 100644
--- a/lib/types/zfs_fs.nix
+++ b/lib/types/zfs_fs.nix
@@ -91,12 +91,14 @@
           updateOptions = builtins.removeAttrs createOptions onetimeProperties;
         in
         ''
-          if ! zfs get type ${config._name} >/dev/null 2>&1; then
+          if ! zfs get type "${config._name}" >/dev/null 2>&1; then
             ${
               if config._createFilesystem then
                 ''
-                  zfs create -up ${config._name} \
-                    ${lib.concatStringsSep " " (lib.mapAttrsToList (n: v: "-o ${n}=${v}") (createOptions))}
+                  zfs create -up "${config._name}" \
+                    ${lib.concatStringsSep " " (
+                      lib.mapAttrsToList (n: v: "-o ${n}=${lib.escapeShellArg v}") (createOptions)
+                    )}
                 ''
               else
                 ''
@@ -107,8 +109,8 @@
           ${lib.optionalString (updateOptions != { }) ''
             else
               zfs set -u ${
-                lib.concatStringsSep " " (lib.mapAttrsToList (n: v: "${n}=${v}") updateOptions)
-              } ${config._name}
+                lib.concatStringsSep " " (lib.mapAttrsToList (n: v: "${n}=${lib.escapeShellArg v}") updateOptions)
+              } "${config._name}"
           ''}
           fi
         '';
diff --git a/lib/types/zfs_volume.nix b/lib/types/zfs_volume.nix
index 8f2b60a..631c243 100644
--- a/lib/types/zfs_volume.nix
+++ b/lib/types/zfs_volume.nix
@@ -63,7 +63,11 @@
       default = ''
         if ! zfs get type "${config._parent.name}/${config.name}" >/dev/null 2>&1; then
           zfs create "${config._parent.name}/${config.name}" \
-            ${lib.concatStringsSep " " (lib.mapAttrsToList (n: v: "-o ${n}=${v}") config.options)} \
+            ${
+              lib.concatStringsSep " " (
+                lib.mapAttrsToList (n: v: "-o ${n}=${lib.escapeShellArg v}") config.options
+              )
+            } \
             -V ${config.size} ${toString (builtins.map lib.escapeShellArg config.extraArgs)}
           zvol_wait
           partprobe "/dev/zvol/${config._parent.name}/${config.name}"
diff --git a/lib/types/zpool.nix b/lib/types/zpool.nix
index f240ebc..f9947a1 100644
--- a/lib/types/zpool.nix
+++ b/lib/types/zpool.nix
@@ -377,8 +377,16 @@ in
                   else
                     ""
                 } \
-                ${lib.concatStringsSep " " (lib.mapAttrsToList (n: v: "-o ${n}=${v}") config.options)} \
-                ${lib.concatStringsSep " " (lib.mapAttrsToList (n: v: "-O ${n}=${v}") config.rootFsOptions)} \
+                ${
+                  lib.concatStringsSep " " (
+                    lib.mapAttrsToList (n: v: "-o ${n}=${lib.escapeShellArg v}") config.options
+                  )
+                } \
+                ${
+                  lib.concatStringsSep " " (
+                    lib.mapAttrsToList (n: v: "-O ${n}=${lib.escapeShellArg v}") config.rootFsOptions
+                  )
+                } \
                 ''${topology:+ $topology}
               if [[ $(zfs get -H mounted "${config.name}" | cut -f3) == "yes" ]]; then
                 zfs unmount "${config.name}"