Jeff King ddbbf8eb25 sq_dequote: fix extra consumption of source string
This fixes a (probably harmless) parsing problem in
sq_dequote_step(), in which we parse some bogus input
incorrectly rather than complaining that it's bogus.

Our shell-dequoting function is very strict: it can unquote
everything generated by sq_quote(), but not arbitrary
strings. In particular, it only allows characters outside of
the single-quoted string if they are immediately backslashed
and then the single-quoted string is resumed. So:

  'foo'\''bar'

is OK. But these are not:

  'foo'\'bar
  'foo'\'
  'foo'\'\''bar'

even though they are all valid shell. The parser has a funny
corner case here. When we see a backslashed character, we
keep incrementing the "src" pointer as we parse it. For a
single sq_dequote() call, that's OK; our next step is to
bail with an error, and we don't care where "src" points.

But if we're parsing multiple strings with sq_dequote_to_argv(),
then our next step is to see if the string is followed by
whitespace. Because we erroneously incremented the "src"
pointer, we don't barf on the bogus backslash that we
skipped. Instead, we may find whitespace that immediately
follows it, and continue as if all is well (skipping the
backslashed character completely!).

In practice, this shouldn't be a big deal. The input is
bogus, and our sq_quote() would never generate this bogus
input. In all but one callers, we are parsing input created
by an earlier call to sq_quote(). That final case is "git
shell", which parses shell-quoting generated by the client.
And in that case we use the singular sq_quote(), which has
always behaved correctly.

One might also wonder if you could provoke a read past the
end of the string. But the answer is no; we still parse
character by character, and would never advance past a NUL.

This patch implements the minimal fix, along with
documenting the restriction (which confused at least me
while reading the code). We should possibly consider
being more liberal in accepting valid shell-quoted words. I
suspect the code may actually be simpler, and it would be
more friendly to anybody generating or editing input by
hand. But I wanted to fix just the immediate bug in this
patch.

We don't have a direct way to unit-test the sq_dequote()
functions, but we can do this by feeding input to
GIT_CONFIG_PARAMETERS (which is not normally a user-facing
interface, but serves here as it expects to see sq_quote()
input from "git -c"). I've included both a bogus example,
and a related "good" one to confirm that we still parse it
correctly.

Noticed-by: Michael Haggerty <mhagger@alum.mit.edu>
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2018-02-14 11:11:49 -08:00
2017-10-23 14:44:17 +09:00
2017-07-10 14:24:36 -07:00
2017-07-06 18:14:44 -07:00
2017-06-27 10:35:49 -07:00
2017-06-24 14:28:41 -07:00
2017-06-24 14:28:41 -07:00
2017-06-24 14:28:41 -07:00
2017-03-13 15:28:54 -07:00
2017-06-24 14:28:41 -07:00
2017-07-31 13:05:15 -07:00
2017-05-25 13:08:23 +09:00
2017-05-08 15:12:57 +09:00
2017-05-08 15:12:57 +09:00
2017-08-03 11:08:10 -07:00
2017-05-29 12:34:43 +09:00
2017-05-02 10:46:41 +09:00
2017-07-17 14:54:56 -07:00
2017-01-25 14:42:37 -08:00
2017-07-17 14:54:56 -07:00
2017-06-22 14:15:20 -07:00
2017-08-04 12:40:37 -07:00
2017-06-24 14:28:41 -07:00
2017-06-24 14:28:41 -07:00
2017-06-19 12:38:44 -07:00
2017-06-22 14:15:21 -07:00
2017-06-24 14:28:41 -07:00
2017-06-24 14:28:41 -07:00
2017-03-31 08:33:56 -07:00
2017-03-31 08:33:56 -07:00
2017-10-23 14:44:17 +09:00
2017-06-24 14:28:41 -07:00
2017-07-12 15:18:23 -07:00
2017-01-30 14:17:00 -08:00
2017-06-24 14:28:41 -07:00
2017-06-24 14:28:41 -07:00
2017-06-24 14:28:41 -07:00
2017-02-08 15:39:55 -08:00
2017-01-30 14:17:00 -08:00
2017-05-29 12:34:43 +09:00
2017-06-24 14:28:41 -07:00
2017-06-30 13:11:54 -07:00
2017-06-27 10:35:49 -07:00
2017-05-29 12:34:43 +09:00
2017-07-17 14:54:56 -07:00
2017-10-18 14:24:09 +09:00
2017-08-02 15:45:20 -07:00
2017-10-03 08:42:57 +09:00
2017-06-27 10:35:49 -07:00
2017-03-31 08:33:56 -07:00
2017-06-13 13:47:09 -07:00
2017-07-12 15:18:23 -07:00
2017-03-31 08:33:56 -07:00
2017-05-22 10:20:46 +09:00
2017-05-22 10:20:46 +09:00
2017-06-24 14:28:41 -07:00
2017-07-17 14:54:56 -07:00
2017-09-22 10:59:52 +09:00
2017-10-02 13:14:33 +09:00
2017-05-29 12:34:43 +09:00
2017-06-24 14:28:41 -07:00
2017-06-24 14:28:41 -07:00
2017-06-24 14:28:41 -07:00
2017-06-24 14:28:41 -07:00
2017-06-24 14:28:41 -07:00

Git - fast, scalable, distributed revision control system

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals.

Git is an Open Source project covered by the GNU General Public License version 2 (some parts of it are under different licenses, compatible with the GPLv2). It was originally written by Linus Torvalds with help of a group of hackers around the net.

Please read the file INSTALL for installation instructions.

Many Git online resources are accessible from https://git-scm.com/ including full documentation and Git related tools.

See Documentation/gittutorial.txt to get started, then see Documentation/giteveryday.txt for a useful minimum set of commands, and Documentation/git-.txt for documentation of each command. If git has been correctly installed, then the tutorial can also be read with man gittutorial or git help tutorial, and the documentation of each command with man git-<commandname> or git help <commandname>.

CVS users may also want to read Documentation/gitcvs-migration.txt (man gitcvs-migration or git help cvs-migration if git is installed).

The user discussion and development of Git take place on the Git mailing list -- everyone is welcome to post bug reports, feature requests, comments and patches to git@vger.kernel.org (read Documentation/SubmittingPatches for instructions on patch submission). To subscribe to the list, send an email with just "subscribe git" in the body to majordomo@vger.kernel.org. The mailing list archives are available at https://public-inbox.org/git/, http://marc.info/?l=git and other archival sites.

The maintainer frequently sends the "What's cooking" reports that list the current status of various development topics to the mailing list. The discussion following them give a good reference for project status, development direction and remaining tasks.

The name "git" was given by Linus Torvalds when he wrote the very first version. He described the tool as "the stupid content tracker" and the name as (depending on your mood):

  • random three-letter combination that is pronounceable, and not actually used by any common UNIX command. The fact that it is a mispronunciation of "get" may or may not be relevant.
  • stupid. contemptible and despicable. simple. Take your pick from the dictionary of slang.
  • "global information tracker": you're in a good mood, and it actually works for you. Angels sing, and a light suddenly fills the room.
  • "goddamn idiotic truckload of sh*t": when it breaks
Description
No description provided
Readme 235 MiB
Languages
C 50.1%
Shell 38.4%
Perl 5.1%
Tcl 3.3%
Python 0.8%
Other 2%