gitweb: quote commands properly when calling the shell
This eliminates the function git_cmd_str, which was used for composing command lines, and adds a quote_command function, which quotes all of its arguments (as in quote.c). Signed-off-by: Lea Wiemann <LeWiemann@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Lea Wiemann committed
Jun 17, 2008 at 23:46 UTC
516381d50ba7acb66f260461f4d566ab9b6df107
1 file changed
+14
-10
gitweb/gitweb.perl
+14
-10
@@ -1500,9 +1500,13 @@ sub git_cmd {
1500
return $GIT, '--git-dir='.$git_dir;
1501
}
1502
1503
-# returns path to the core git executable and the --git-dir parameter as string
1504
-sub git_cmd_str {
1505
- return join(' ', git_cmd());
1503
+# quote the given arguments for passing them to the shell
1504
+# quote_command("command", "arg 1", "arg with ' and ! characters")
1505
+# => "'command' 'arg 1' 'arg with '\'' and '\!' characters'"
1506
+# Try to avoid using this function wherever possible.
1507
+sub quote_command {
1508
+ return join(' ',
1509
+ map( { my $a = $_; $a =~ s/(['!])/'\\$1'/g; "'$a'" } @_ ));
1510
}
1511
1512
# get HEAD ref of given project as hash
@@ -4633,7 +4637,6 @@ sub git_snapshot {
4637
$hash = git_get_head_hash($project);
4638
}
4639
4636
- my $git_command = git_cmd_str();
4640
my $name = $project;
4641
$name =~ s,([^/])/*\.git$,$1,;
4642
$name = basename($name);
@@ -4641,11 +4644,12 @@ sub git_snapshot {
4644
$name =~ s/\047/\047\\\047\047/g;
4645
my $cmd;
4646
$filename .= "-$hash$known_snapshot_formats{$format}{'suffix'}";
4644
- $cmd = "$git_command archive " .
4645
- "--format=$known_snapshot_formats{$format}{'format'} " .
4646
- "--prefix=\'$name\'/ $hash";
4647
+ $cmd = quote_command(
4648
+ git_cmd(), 'archive',
4649
+ "--format=$known_snapshot_formats{$format}{'format'}",
4650
+ "--prefix=$name/", $hash);
4651
if (exists $known_snapshot_formats{$format}{'compressor'}) {
4648
- $cmd .= ' | ' . join ' ', @{$known_snapshot_formats{$format}{'compressor'}};
4652
+ $cmd .= ' | ' . quote_command(@{$known_snapshot_formats{$format}{'compressor'}});
4653
}
4654
4655
print $cgi->header(
@@ -4858,8 +4862,8 @@ sub git_object {
4862
if ($hash || ($hash_base && !defined $file_name)) {
4863
my $object_id = $hash || $hash_base;
4864
4861
- my $git_command = git_cmd_str();
4862
- open my $fd, "-|", "$git_command cat-file -t $object_id 2>/dev/null"
4865
+ open my $fd, "-|", quote_command(
4866
+ git_cmd(), 'cat-file', '-t', $object_id) . ' 2> /dev/null'
4867
or die_error('404 Not Found', "Object does not exist");
4868
$type = <$fd>;
4869
chomp $type;