curl and httpie export change the body when it has % or a trailing newline

Problem Description

The curl and httpie export changes the request body when the body has a control character (for example a newline) together with %, a backslash, or a newline at the end. The exported command sends different bytes than the original request.

The body is passed as "$(printf '...')". printf treats % as a format directive and \n, \t and other backslash sequences as escapes. $(...) also removes newlines at the end of the output.

I ran the exported commands in bash against a local server and compared the bytes:

A JSON body that ends with a newline is very common, so the first case happens a lot.

Steps to reproduce the behavior:

1. Capture a POST request whose body is {"a":1} followed by a newline.
2. Run export.clip curl @focus (or :export.clip curl @focus in the console) and paste the command into bash.
3. The server gets {"a":1} without the newline. With a body like a=100% followed by a newline the server gets only a=100.

Bodies without control characters are fine, they go through shlex.quote.

A fix is to use ANSI-C quoting ($'...') instead of printf. It expands \xNN byte for byte and does not touch %. I tested it in bash and zsh, all bodies above arrive unchanged. I will open a pull request.

System Information

Mitmproxy: 13.0.0.dev (+79, commit 2ac5b08)
Python:    3.14.6
OpenSSL:   OpenSSL 3.5.5 27 Jan 2026
Platform:  macOS-26.5.2-arm64-arm-64bit-Mach-O

The printf code is unchanged since 11.1.0 (#7520), so the latest release is affected too.

Checklist

• This bug affects the latest mitmproxy release.

Start at the curl and httpie export paths invoked by export.clip curl @focus or :export.clip curl @focus in the console, then reproduce the examples against a local server and compare received bytes. Check the existing printf and shlex.quote handling; done means exported commands preserve percent signs, backslashes, control characters, and trailing newlines in bash and zsh.