Re: Summary of core GIT while you are away.

KS> I see what you mean, but allow to pass any charater through a cgi to a KS> invoked shell as a command-line option is a nightmare without being very KS> carful.

You are absolutely right that you must be careful. But being careful is not that hard.

I do not know what you are using to parse the data coming from the browser (presumably application/x-www-form-urlencoded or somesuch), but once you got the raw data out of it in a variable in your host language (sorry I do not know what language you are writing in, either), quoting that value safely for shell command line is very simple and easy. You can emulate what sq_expand() in diff.c does.

Essentially you take advantage of single quote quoting which lets you pass anything other than single quotes as literals, and deal with single quotes by stepping out temporarily of the single quote environment every time you see a single quote, quote that single quote with a backslash, and immediately after that you go back into single quote environment again and continue.

  original     sq_expand     result
  name     ==> name      ==> 'name'
  a b      ==> a b       ==> 'a b'
  a'b      ==> a'\''b    ==> 'a'\''b'

So in shell, using sed, you would do something like this:

------------ #!/bin/sh

orig="foo '"'\bar b az'

script="s/'/'\\\\\\''/g" ;# change (') to ('\'')

sq_inside=`echo "$orig" | sed "$script"`

echo "'$sq_inside'" ;# and enclose the whole thing in sq pair ------------