From: Phillip Wood <phillip.wood123@gmail.com>
Date: Wed, 25 Jun 2025 13:57:36 GMT
Subject: Re: bash: unescaped `>` character when switching branches
Message-ID: <84eccfa1-88fe-43b8-a839-61ea4fa4e4e9@gmail.com>
In-Reply-To: <8515698b-4ab7-4901-bacb-1c47180c2530@app.fastmail.com>

On 25/06/2025 09:53, Kristoffer Haugsbakk wrote:
> On Tue, Jun 24, 2025, at 14:59, Ondrej Pohorelsky wrote:
>> Hi,
>>
>> Our customer has found a possible issue when switching branches.
>> Output redirection character `>` is not escaped properly when
>> switching/checking out to different branch.
>>
>> Steps to reproduce:
>> 1. Create a new branch and switch back to master
>> ```
>> $ git switch -C 'issue#1234>/tmp/dangerfile'
>> Switched to a new branch 'issue#1234>/tmp/dangerfile'
>> $ git switch master
>> ```
> 
> It’s too bad that git-check-ref-format(1) does not disallow `>`.

It also allows `<`, `$`, `&`, `;`, `(`, `)`, `#`, `"`, `'`, '`' and `|`. 
Our ref format is not designed for them to be used unquoted in the 
shell. I think the problem here is with our completion script not 
quoting the refname, not the format.

Best Wishes

Phillip
> It would be nice to have an opt-in extension to the ref format check
> which disallows `>`.
>