Completely quote AppPath and CustomConf paths (#12955)
* Completely quote AppPath and CustomConf paths Properly handle spaces in AppPath and CustomConf within hooks and authorized_keys. Unfortunately here we don't seem to be able to get away with using go-shellquote as it appears that Windows doesn't play too well with singlequote quoting - therefore we will avoid singlequote quoting unless we absolutely cannot get away without it, e.g. \n or !. Fix #10813 Signed-off-by: Andrew Thornton <art27@cantab.net> * missing change Signed-off-by: Andrew Thornton <art27@cantab.net> * fix Test_CmdKeys Signed-off-by: Andrew Thornton <art27@cantab.net>mj-v1.14.3
parent
5cfc1f573f
commit
4c6ac08182
@ -0,0 +1,92 @@
|
|||||||
|
// Copyright 2020 The Gitea Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a MIT-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package util
|
||||||
|
|
||||||
|
import "testing"
|
||||||
|
|
||||||
|
func TestShellEscape(t *testing.T) {
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
toEscape string
|
||||||
|
want string
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
"Simplest case - nothing to escape",
|
||||||
|
"a/b/c/d",
|
||||||
|
"a/b/c/d",
|
||||||
|
}, {
|
||||||
|
"Prefixed tilde - with normal stuff - should not escape",
|
||||||
|
"~/src/go/gitea/gitea",
|
||||||
|
"~/src/go/gitea/gitea",
|
||||||
|
}, {
|
||||||
|
"Typical windows path with spaces - should get doublequote escaped",
|
||||||
|
`C:\Program Files\Gitea v1.13 - I like lots of spaces\gitea`,
|
||||||
|
`"C:\\Program Files\\Gitea v1.13 - I like lots of spaces\\gitea"`,
|
||||||
|
}, {
|
||||||
|
"Forward-slashed windows path with spaces - should get doublequote escaped",
|
||||||
|
"C:/Program Files/Gitea v1.13 - I like lots of spaces/gitea",
|
||||||
|
`"C:/Program Files/Gitea v1.13 - I like lots of spaces/gitea"`,
|
||||||
|
}, {
|
||||||
|
"Prefixed tilde - but then a space filled path",
|
||||||
|
"~git/Gitea v1.13/gitea",
|
||||||
|
`~git/"Gitea v1.13/gitea"`,
|
||||||
|
}, {
|
||||||
|
"Bangs are unforutunately not predictable so need to be singlequoted",
|
||||||
|
"C:/Program Files/Gitea!/gitea",
|
||||||
|
`'C:/Program Files/Gitea!/gitea'`,
|
||||||
|
}, {
|
||||||
|
"Newlines are just irritating",
|
||||||
|
"/home/git/Gitea\n\nWHY-WOULD-YOU-DO-THIS\n\nGitea/gitea",
|
||||||
|
"'/home/git/Gitea\n\nWHY-WOULD-YOU-DO-THIS\n\nGitea/gitea'",
|
||||||
|
}, {
|
||||||
|
"Similarly we should nicely handle mutiple single quotes if we have to single-quote",
|
||||||
|
"'!''!'''!''!'!'",
|
||||||
|
`\''!'\'\''!'\'\'\''!'\'\''!'\''!'\'`,
|
||||||
|
}, {
|
||||||
|
"Double quote < ...",
|
||||||
|
"~/<gitea",
|
||||||
|
"~/\"<gitea\"",
|
||||||
|
}, {
|
||||||
|
"Double quote > ...",
|
||||||
|
"~/gitea>",
|
||||||
|
"~/\"gitea>\"",
|
||||||
|
}, {
|
||||||
|
"Double quote and escape $ ...",
|
||||||
|
"~/$gitea",
|
||||||
|
"~/\"\\$gitea\"",
|
||||||
|
}, {
|
||||||
|
"Double quote {...",
|
||||||
|
"~/{gitea",
|
||||||
|
"~/\"{gitea\"",
|
||||||
|
}, {
|
||||||
|
"Double quote }...",
|
||||||
|
"~/gitea}",
|
||||||
|
"~/\"gitea}\"",
|
||||||
|
}, {
|
||||||
|
"Double quote ()...",
|
||||||
|
"~/(gitea)",
|
||||||
|
"~/\"(gitea)\"",
|
||||||
|
}, {
|
||||||
|
"Double quote and escape `...",
|
||||||
|
"~/gitea`",
|
||||||
|
"~/\"gitea\\`\"",
|
||||||
|
}, {
|
||||||
|
"Double quotes can handle a number of things without having to escape them but not everything ...",
|
||||||
|
"~/<gitea> ${gitea} `gitea` [gitea] (gitea) \"gitea\" \\gitea\\ 'gitea'",
|
||||||
|
"~/\"<gitea> \\${gitea} \\`gitea\\` [gitea] (gitea) \\\"gitea\\\" \\\\gitea\\\\ 'gitea'\"",
|
||||||
|
}, {
|
||||||
|
"Single quotes don't need to escape except for '...",
|
||||||
|
"~/<gitea> ${gitea} `gitea` (gitea) !gitea! \"gitea\" \\gitea\\ 'gitea'",
|
||||||
|
"~/'<gitea> ${gitea} `gitea` (gitea) !gitea! \"gitea\" \\gitea\\ '\\''gitea'\\'",
|
||||||
|
},
|
||||||
|
}
|
||||||
|
for _, tt := range tests {
|
||||||
|
t.Run(tt.name, func(t *testing.T) {
|
||||||
|
if got := ShellEscape(tt.toEscape); got != tt.want {
|
||||||
|
t.Errorf("ShellEscape(%q):\nGot: %s\nWanted: %s", tt.toEscape, got, tt.want)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
Loading…
Reference in new issue