Re: gitweb: using quotemeta

From: Luben Tuikov <ltuikov@yahoo.com>
Date: Oct 2, 2006, 20:12 UTC
Message-ID: <20061002201256.89409.qmail@web31809.mail.mud.yahoo.com>
In-Reply-To: <efpme9$o13$1@sea.gmane.org>

--- Jakub Narebski <jnareb@gmail.com> wrote:

Show 21 quoted lines

> Luben Tuikov wrote:
> 
> > --- Junio C Hamano <junkio@cox.net> wrote:
> >> 
> >> Ouch, that was a sloppy planning and coding, and sloppier
> >> reviewing.  Sorry.
> >> 
> >> What is the right quoting there?  Just quoting double-quotes?
> > 
> > I'm not sure.  What undesired character could we have in $filename
> > of a snapshot?  The commit ab41dfbfd4f message gives this
> > justification: "Just in case filename contains end of line character."
> > 
> > It looks like $filename is constructed by well defined strings:
> > basename($project), $hash and $suffix all of which should be ok.
> > 
> > I'd say we don't need quotemeta for $filename of snapshot.
> 
> But we do need quoting for blob_plain and perhaps blobdiff_plain
> views, although not quotemeta, but perhaps the reverse of unescape,
> i.e. quote '"', EOLN (end of line) and perhaps also TAB.

Escaping for the purposes of HTML _view_ and URL generation is ok, but it is not ok when _saving_ the file with a file name.

A file name is just a string of chars, and I want to _save_ the file name as its name is. No changes or interpretations please. I don't care what the string is, what chars it is made of, etc.

Please don't interpret file names and their characters when the files are _saved_ by the user's browser.

The file name in my filesystem should be the exact same file name as it appears on any other filesystem hosting the same git repo.

I don't want this translation:
Server FS: linux-2.6.git-5c2d97cb31fb77981797fec46230ca005b865799.tar.gz
Quotemeta: linux\-2\.6\.git\-5c2d97cb31fb77981797fec46230ca005b865799\.tar\.gz
User FS: linux\-2\.6\.git\-5c2d97cb31fb77981797fec46230ca005b865799\.tar\.gz

When you comitted ab41dfbfd4f3f9fedac71550027e9813b11abe3d, it extended quotemeta to where it shouldn't have been applied.

    Luben
P.S. When replying please don't redact the CC field.