...
the accounting logs end up showing -
0510/1218/2015 2016 16:01:33;S;11039.r-man4server;user=aww900 someone group=z00 group1 account="value" malicious="evil" ...
...
- if (value enclosed within quotes)
if (current character is an escape)
copy next character to the value.
if (current character is an escaped quote)
copy only a quote to the value.
if (current character is a non-escaped quote)
we have reached end of the string, do not copy this quote to the value.
else
copy the value as-is.
After this change, the example accounting record will look like -
10/18/2016 16:01:33;S;11039.server;user=someone group=group1 account="value\" malicious=\"evil" ...
However, tracejob output will be kept as-is.