From: Junio C Hamano <junkio@cox.net>
Date: Fri, 27 May 2005 00:40:54 GMT
Subject: Re: Summary of core GIT while you are away.
Message-ID: <7vsm097b6x.fsf@assigned-by-dhcp.cox.net>
In-Reply-To: <20050526235944.GB6215@vrfy.org>

>>>>> "KS" == Kay Sievers <kay.sievers@vrfy.org> writes:

KS> I see what you mean, but allow to pass any charater through a cgi to a
KS> invoked shell as a command-line option is a nightmare without being very
KS> carful.

You are absolutely right that you must be careful.  But being
careful is not that hard.

I do not know what you are using to parse the data coming from
the browser (presumably application/x-www-form-urlencoded or
somesuch), but once you got the raw data out of it in a variable
in your host language (sorry I do not know what language you are
writing in, either), quoting that value safely for shell command
line is very simple and easy.  You can emulate what sq_expand()
in diff.c does.

Essentially you take advantage of single quote quoting which
lets you pass anything other than single quotes as literals, and
deal with single quotes by stepping out temporarily of the
single quote environment every time you see a single quote,
quote that single quote with a backslash, and immediately after
that you go back into single quote environment again and continue.

  original     sq_expand     result
  name     ==> name      ==> 'name'
  a b      ==> a b       ==> 'a b'
  a'b      ==> a'\''b    ==> 'a'\''b'

So in shell, using sed, you would do something like this:

------------
#!/bin/sh

orig="foo '"'\bar	b
az'

script="s/'/'\\\\\\''/g" ;# change (') to ('\'')

sq_inside=`echo "$orig" | sed "$script"`

echo "'$sq_inside'" ;# and enclose the whole thing in sq pair
------------