request-pull: quote regex metacharacters in local ref
The local part of the third argument of git-request-pull is used in a regular expression without quoting it. Use qr{} and \Q\E to ensure that e.g. a period in a tag name does not match any character on the remote side. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Paolo Bonzini committed
May 28, 2019 at 12:15 UTC
5731dfce06a19f59aa1be2bd2120584864d8983b
2 files changed
+20
-3
git-request-pull.sh
+2
-3
@@ -83,19 +83,18 @@ die "fatal: No commits in common between $base and $head"
83
# Otherwise find a random ref that matches $headrev.
84
find_matching_ref='
85
my ($head,$headrev) = (@ARGV);
86
+ my $pattern = qr{/\Q$head\E$};
87
my ($found);
88
89
while (<STDIN>) {
90
chomp;
91
my ($sha1, $ref, $deref) = /^(\S+)\s+([^^]+)(\S*)$/;
91
- my ($pattern);
92
next unless ($sha1 eq $headrev);
93
94
- $pattern="/$head\$";
94
if ($ref eq $head) {
95
$found = $ref;
96
}
98
- if ($ref =~ /$pattern/) {
97
+ if ($ref =~ $pattern) {
98
$found = $ref;
99
}
100
if ($sha1 eq $head) {
t/t5150-request-pull.sh
+18
@@ -246,4 +246,22 @@ test_expect_success 'request-pull ignores OPTIONS_KEEPDASHDASH poison' '
246
247
'
248
249
+test_expect_success 'request-pull quotes regex metacharacters properly' '
250
+
251
+ rm -fr downstream.git &&
252
+ git init --bare downstream.git &&
253
+ (
254
+ cd local &&
255
+ git checkout initial &&
256
+ git merge --ff-only master &&
257
+ git tag -mrelease v2.0 &&
258
+ git push origin refs/tags/v2.0:refs/tags/v2-0 &&
259
+ test_must_fail git request-pull initial "$downstream_url" tags/v2.0 \
260
+ 2>../err
261
+ ) &&
262
+ grep "No match for commit .*" err &&
263
+ grep "Are you sure you pushed" err
264
+
265
+'
266
+
267
test_done