Re: git-pull-script hates me

quoted

quoted

quoted

quoted

"LT" == Linus Torvalds [off-list ref] writes:

LT> But yeah, it's being a bit too anal. Just look at connect.c: shell_safe(),
LT> and add both '_' and '@' to the safe list (and any other safe characters),
LT> and off you go.

LT> And if somebody wants to add code to do proper escaping of the non-safe 
LT> ones, we can do that too. I was just lazy and added the characters I ever 
LT> use ;)

Anybody who is interested in doing this can just move
sq_expand() from diff.c to some public library and expose it in
cache.h.

I am not going to do it myself immediately so there is no worry
to race against me ;-).

On Wed, 6 Jul 2005, Junio C Hamano wrote:

Anybody who is interested in doing this can just move
sq_expand() from diff.c to some public library and expose it in
cache.h.

No, that doesn't work at all.

"sq_expand()" tries to protect things inside single quotes. That's a 
totally different problem (and btw, it does so badly: it doesn't quote '\' 
for example).

For a shell command line, there are _tons_ of special characters that you
mustn't pass through. Things like ';', '<', '>', '&' all have magic
meaning and are not valid in the destination name. Not to mention just
simple whitespace.

		Linus