Add single quotes for inner command.

Change to bash as interpreter.
Forbid single quotes for user commands.

internal/api/runners.go

@@ -14,6 +14,7 @@ import (
 	"net/http"
 	"net/url"
 	"strconv"
+	"strings"
 )
 
 const (
@@ -31,6 +32,8 @@ const (
 	PrivilegedExecutionKey  = "privilegedExecution"
 )
 
+var ErrForbiddenCharacter = errors.New("use of forbidden character")
+
 type RunnerController struct {
 	manager      runner.Accessor
 	runnerRouter *mux.Router
@@ -160,6 +163,11 @@ func (r *RunnerController) execute(writer http.ResponseWriter, request *http.Req
 	if err := parseJSONRequestBody(writer, request, executionRequest); err != nil {
 		return
 	}
+	forbiddenCharacters := "'"
+	if strings.ContainsAny(executionRequest.Command, forbiddenCharacters) {
+		writeClientError(writer, ErrForbiddenCharacter, http.StatusBadRequest)
+		return
+	}
 
 	var scheme string
 	if config.Config.Server.TLS.Active {