Escape quotes, backslashes, $ and non-ASCII in text sent to RouterOS

Until now, a comment containing quotation marks could make a MikroTik tool fail, or silently store something else. This pull request escapes free text before it goes into a RouterOS command, so a comment, a log prefix, an SSID or a password lands on the router exactly as the caller wrote it. It covers thirty-nine tools.

Inside a double quoted string, RouterOS reads quote, backslash and dollar as syntax, and it turns raw UTF-8 bytes into blanks. A comment with quotes is refused. A backslash becomes a backspace. A dollar amount loses its number. And accented or Japanese text is cut off. A password with any of these was set to a different password than the one given. About twenty tools answered success while the router was unchanged.

The helper already existed for a few filters. It now escapes quote, backslash and dollar. It also sends control and non-ASCII characters as backslash hex byte escapes, which RouterOS stores and prints back correctly. Plain ASCII text is unchanged. The write tools use it for comments, log prefixes, TXT text, SSIDs and passwords. For add user and update user, both the raw and the escaped password are declared for log redaction, so the escaped form never reaches the log. The private helper in the wireless module goes away, since it missed the dollar sign.

The new test file drives every affected tool. Forty-seven of its fifty-four cases fail on master and all pass here, and the whole unit suite passes. In the lab, the grid of sixteen create tools against nine kinds of text went from eighty-five exact matches to all one hundred fifty-three, on RouterOS 7.21 and 7.25. And a user created with a nasty password logs in with it, and after an update only the new password works.

The author lists what is left. Names, identifiers and the filter values of read tools are still interpolated as they are. Tools that say added successfully for any reply without the word error still do so for other refusals, such as a wrong interface name, and that is a separate fix. And the write tools in the two open pull requests, one twenty-seven and one eighty-eight, need the same helper. A reviewer should check the call sites in users and wireless first, since those carry passwords.