-
-
Notifications
You must be signed in to change notification settings - Fork 5.9k
Completely quote AppPath and CustomConf paths #12955
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
techknowlogick
merged 5 commits into
go-gitea:master
from
zeripath:fix-10813-spaces-in-AppPath
Sep 29, 2020
Merged
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit
Hold shift + click to select a range
0db8d7f
Completely quote AppPath and CustomConf paths
zeripath 8ef1190
missing change
zeripath 49e8b5e
Merge remote-tracking branch 'origin/master' into shellquote
zeripath c72ea72
fix Test_CmdKeys
zeripath 692274c
Merge branch 'master' into fix-10813-spaces-in-AppPath
techknowlogick File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| // Copyright 2020 The Gitea Authors. All rights reserved. | ||
| // Use of this source code is governed by a MIT-style | ||
| // license that can be found in the LICENSE file. | ||
|
|
||
| package util | ||
|
|
||
| import "strings" | ||
|
|
||
| // Bash has the definition of a metacharacter: | ||
| // * A character that, when unquoted, separates words. | ||
| // A metacharacter is one of: " \t\n|&;()<>" | ||
| // | ||
| // The following characters also have addition special meaning when unescaped: | ||
| // * ‘${[*?!"'`\’ | ||
| // | ||
| // Double Quotes preserve the literal value of all characters with then quotes | ||
| // excepting: ‘$’, ‘`’, ‘\’, and, when history expansion is enabled, ‘!’. | ||
| // The backslash retains its special meaning only when followed by one of the | ||
| // following characters: ‘$’, ‘`’, ‘"’, ‘\’, or newline. | ||
| // Backslashes preceding characters without a special meaning are left | ||
| // unmodified. A double quote may be quoted within double quotes by preceding | ||
| // it with a backslash. If enabled, history expansion will be performed unless | ||
| // an ‘!’ appearing in double quotes is escaped using a backslash. The | ||
| // backslash preceding the ‘!’ is not removed. | ||
| // | ||
| // -> This means that `!\n` cannot be safely expressed in `"`. | ||
| // | ||
| // Looking at the man page for Dash and ash the situation is similar. | ||
| // | ||
| // Now zsh requires that ‘}’, and ‘]’ are also enclosed in doublequotes or escaped | ||
| // | ||
| // Single quotes escape everything except a ‘'’ | ||
| // | ||
| // There's one other gotcha - ‘~’ at the start of a string needs to be expanded | ||
| // because people always expect that - of course if there is a special character before '/' | ||
| // this is not going to work | ||
|
|
||
| const ( | ||
| tildePrefix = '~' | ||
| needsEscape = " \t\n|&;()<>${}[]*?!\"'`\\" | ||
| needsSingleQuote = "!\n" | ||
| ) | ||
|
|
||
| var doubleQuoteEscaper = strings.NewReplacer(`$`, `\$`, "`", "\\`", `"`, `\"`, `\`, `\\`) | ||
| var singleQuoteEscaper = strings.NewReplacer(`'`, `'\''`) | ||
| var singleQuoteCoalescer = strings.NewReplacer(`''\'`, `\'`, `\'''`, `\'`) | ||
|
|
||
| // ShellEscape will escape the provided string. | ||
| // We can't just use go-shellquote here because our preferences for escaping differ from those in that we want: | ||
| // | ||
| // * If the string doesn't require any escaping just leave it as it is. | ||
| // * If the string requires any escaping prefer double quote escaping | ||
| // * If we have ! or newlines then we need to use single quote escaping | ||
| func ShellEscape(toEscape string) string { | ||
| if len(toEscape) == 0 { | ||
| return toEscape | ||
| } | ||
|
|
||
| start := 0 | ||
|
|
||
| if toEscape[0] == tildePrefix { | ||
| // We're in the forcibly non-escaped section... | ||
| idx := strings.IndexRune(toEscape, '/') | ||
| if idx < 0 { | ||
| idx = len(toEscape) | ||
| } else { | ||
| idx++ | ||
| } | ||
| if !strings.ContainsAny(toEscape[:idx], needsEscape) { | ||
| // We'll assume that they intend ~ expansion to occur | ||
| start = idx | ||
| } | ||
| } | ||
|
|
||
| // Now for simplicity we'll look at the rest of the string | ||
| if !strings.ContainsAny(toEscape[start:], needsEscape) { | ||
| return toEscape | ||
| } | ||
|
|
||
| // OK we have to do some escaping | ||
| sb := &strings.Builder{} | ||
| _, _ = sb.WriteString(toEscape[:start]) | ||
|
|
||
| // Do we have any characters which absolutely need to be within single quotes - that is simply ! or \n? | ||
| if strings.ContainsAny(toEscape[start:], needsSingleQuote) { | ||
| // We need to single quote escape. | ||
| sb2 := &strings.Builder{} | ||
| _, _ = sb2.WriteRune('\'') | ||
| _, _ = singleQuoteEscaper.WriteString(sb2, toEscape[start:]) | ||
| _, _ = sb2.WriteRune('\'') | ||
| _, _ = singleQuoteCoalescer.WriteString(sb, sb2.String()) | ||
| return sb.String() | ||
| } | ||
|
|
||
| // OK we can just use " just escape the things that need escaping | ||
| _, _ = sb.WriteRune('"') | ||
| _, _ = doubleQuoteEscaper.WriteString(sb, toEscape[start:]) | ||
| _, _ = sb.WriteRune('"') | ||
| return sb.String() | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,92 @@ | ||
| // Copyright 2020 The Gitea Authors. All rights reserved. | ||
| // Use of this source code is governed by a MIT-style | ||
| // license that can be found in the LICENSE file. | ||
|
|
||
| package util | ||
|
|
||
| import "testing" | ||
|
|
||
| func TestShellEscape(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| toEscape string | ||
| want string | ||
| }{ | ||
| { | ||
| "Simplest case - nothing to escape", | ||
| "a/b/c/d", | ||
| "a/b/c/d", | ||
| }, { | ||
| "Prefixed tilde - with normal stuff - should not escape", | ||
| "~/src/go/gitea/gitea", | ||
| "~/src/go/gitea/gitea", | ||
| }, { | ||
| "Typical windows path with spaces - should get doublequote escaped", | ||
| `C:\Program Files\Gitea v1.13 - I like lots of spaces\gitea`, | ||
| `"C:\\Program Files\\Gitea v1.13 - I like lots of spaces\\gitea"`, | ||
techknowlogick marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| }, { | ||
| "Forward-slashed windows path with spaces - should get doublequote escaped", | ||
| "C:/Program Files/Gitea v1.13 - I like lots of spaces/gitea", | ||
| `"C:/Program Files/Gitea v1.13 - I like lots of spaces/gitea"`, | ||
| }, { | ||
| "Prefixed tilde - but then a space filled path", | ||
| "~git/Gitea v1.13/gitea", | ||
| `~git/"Gitea v1.13/gitea"`, | ||
| }, { | ||
| "Bangs are unforutunately not predictable so need to be singlequoted", | ||
| "C:/Program Files/Gitea!/gitea", | ||
| `'C:/Program Files/Gitea!/gitea'`, | ||
| }, { | ||
| "Newlines are just irritating", | ||
| "/home/git/Gitea\n\nWHY-WOULD-YOU-DO-THIS\n\nGitea/gitea", | ||
| "'/home/git/Gitea\n\nWHY-WOULD-YOU-DO-THIS\n\nGitea/gitea'", | ||
| }, { | ||
| "Similarly we should nicely handle mutiple single quotes if we have to single-quote", | ||
| "'!''!'''!''!'!'", | ||
| `\''!'\'\''!'\'\'\''!'\'\''!'\''!'\'`, | ||
| }, { | ||
| "Double quote < ...", | ||
| "~/<gitea", | ||
| "~/\"<gitea\"", | ||
| }, { | ||
| "Double quote > ...", | ||
| "~/gitea>", | ||
| "~/\"gitea>\"", | ||
| }, { | ||
| "Double quote and escape $ ...", | ||
| "~/$gitea", | ||
| "~/\"\\$gitea\"", | ||
| }, { | ||
| "Double quote {...", | ||
| "~/{gitea", | ||
| "~/\"{gitea\"", | ||
| }, { | ||
| "Double quote }...", | ||
| "~/gitea}", | ||
| "~/\"gitea}\"", | ||
| }, { | ||
| "Double quote ()...", | ||
| "~/(gitea)", | ||
| "~/\"(gitea)\"", | ||
| }, { | ||
| "Double quote and escape `...", | ||
| "~/gitea`", | ||
| "~/\"gitea\\`\"", | ||
| }, { | ||
| "Double quotes can handle a number of things without having to escape them but not everything ...", | ||
| "~/<gitea> ${gitea} `gitea` [gitea] (gitea) \"gitea\" \\gitea\\ 'gitea'", | ||
| "~/\"<gitea> \\${gitea} \\`gitea\\` [gitea] (gitea) \\\"gitea\\\" \\\\gitea\\\\ 'gitea'\"", | ||
| }, { | ||
| "Single quotes don't need to escape except for '...", | ||
| "~/<gitea> ${gitea} `gitea` (gitea) !gitea! \"gitea\" \\gitea\\ 'gitea'", | ||
| "~/'<gitea> ${gitea} `gitea` (gitea) !gitea! \"gitea\" \\gitea\\ '\\''gitea'\\'", | ||
| }, | ||
| } | ||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| if got := ShellEscape(tt.toEscape); got != tt.want { | ||
| t.Errorf("ShellEscape(%q):\nGot: %s\nWanted: %s", tt.toEscape, got, tt.want) | ||
| } | ||
| }) | ||
| } | ||
| } | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.