finn/forgejo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Completely quote AppPath and CustomConf paths (#12955)

Browse source 
* Completely quote AppPath and CustomConf paths

Properly handle spaces in AppPath and CustomConf within hooks and
authorized_keys. Unfortunately here we don't seem to be able to get away
with using go-shellquote as it appears that Windows doesn't play too
well with singlequote quoting - therefore we will avoid singlequote
quoting unless we absolutely cannot get away without it, e.g. \n or !.

Fix #10813

Signed-off-by: Andrew Thornton <art27@cantab.net>

* missing change

Signed-off-by: Andrew Thornton <art27@cantab.net>

* fix Test_CmdKeys

Signed-off-by: Andrew Thornton <art27@cantab.net>
This commit is contained in:
zeripath 2020-09-29 02:16:52 +01:00 • committed by GitHub
parent 5cfc1f573f
commit 4c6ac08182
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 200 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

92
modules/util/shellquote_test.go Normal file
View file

@ -0,0 +1,92 @@
// Copyright 2020 The Gitea Authors. All rights reserved.
// Use of this source code is governed by a MIT-style
// license that can be found in the LICENSE file.
package util
import "testing"
func TestShellEscape(t *testing.T) {
tests := []struct {
name string
toEscape string
want string
}{
{
"Simplest case - nothing to escape",
"a/b/c/d",
"a/b/c/d",
}, {
"Prefixed tilde - with normal stuff - should not escape",
"~/src/go/gitea/gitea",
"~/src/go/gitea/gitea",
}, {
"Typical windows path with spaces - should get doublequote escaped",
`C:\Program Files\Gitea v1.13 - I like lots of spaces\gitea`,
`"C:\\Program Files\\Gitea v1.13 - I like lots of spaces\\gitea"`,
}, {
"Forward-slashed windows path with spaces - should get doublequote escaped",
"C:/Program Files/Gitea v1.13 - I like lots of spaces/gitea",
`"C:/Program Files/Gitea v1.13 - I like lots of spaces/gitea"`,
}, {
"Prefixed tilde - but then a space filled path",
"~git/Gitea v1.13/gitea",
`~git/"Gitea v1.13/gitea"`,
}, {
"Bangs are unforutunately not predictable so need to be singlequoted",
"C:/Program Files/Gitea!/gitea",
`'C:/Program Files/Gitea!/gitea'`,
}, {
"Newlines are just irritating",
"/home/git/Gitea\n\nWHY-WOULD-YOU-DO-THIS\n\nGitea/gitea",
"'/home/git/Gitea\n\nWHY-WOULD-YOU-DO-THIS\n\nGitea/gitea'",
}, {
"Similarly we should nicely handle mutiple single quotes if we have to single-quote",
"'!''!'''!''!'!'",
`\''!'\'\''!'\'\'\''!'\'\''!'\''!'\'`,
}, {
"Double quote < ...",
"~/<gitea",
"~/\"<gitea\"",
}, {
"Double quote > ...",
"~/gitea>",
"~/\"gitea>\"",
}, {
"Double quote and escape $ ...",
"~/$gitea",
"~/\"\\$gitea\"",
}, {
"Double quote {...",
"~/{gitea",
"~/\"{gitea\"",
}, {
"Double quote }...",
"~/gitea}",
"~/\"gitea}\"",
}, {
"Double quote ()...",
"~/(gitea)",
"~/\"(gitea)\"",
}, {
"Double quote and escape `...",
"~/gitea`",
"~/\"gitea\\`\"",
}, {
"Double quotes can handle a number of things without having to escape them but not everything ...",
"~/<gitea> ${gitea} `gitea` [gitea] (gitea) \"gitea\" \\gitea\\ 'gitea'",
"~/\"<gitea> \\${gitea} \\`gitea\\` [gitea] (gitea) \\\"gitea\\\" \\\\gitea\\\\ 'gitea'\"",
}, {
"Single quotes don't need to escape except for '...",
"~/<gitea> ${gitea} `gitea` (gitea) !gitea! \"gitea\" \\gitea\\ 'gitea'",
"~/'<gitea> ${gitea} `gitea` (gitea) !gitea! \"gitea\" \\gitea\\ '\\''gitea'\\'",
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
if got := ShellEscape(tt.toEscape); got != tt.want {
t.Errorf("ShellEscape(%q):\nGot: %s\nWanted: %s", tt.toEscape, got, tt.want)
}
})
}
}