git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] Put quotes around branch names to prevent special characters from being interpreted by the shell.

From
Ian Ward Comfort <icomfort@stanford.edu>
Date
Jun 7, 2010, 06:01 UTC
Message-ID
<EE9EE2D7-B15C-4858-A4C1-B045FD5AC6BA@stanford.edu>
In-Reply-To
<AANLkTik7PV-2u24UF78U6rtuffw4XUGS1F4hD2_ElrZZ@mail.gmail.com>
On 6 Jun 2010, at 10:48 PM, Ævar Arnfjörð Bjarmason wrote:
Show 9 quoted lines
> On Mon, Jun 7, 2010 at 05:10, Jay Soffian <jaysoffian@gmail.com>  
> wrote:
>> BTW, quotemeta is technically intended for use with regular  
>> expressions, isn't it?
>
> Yes, it's completely insecure to use it for shell interpolation.
>
> In Perl it's best to use the list form of system() so that the  
> command will escape things for you automatically.

Passing a list to system() actually ensures that Perl will call execvp directly, instead of looking for metacharacters and possibly invoking the system shell. (But this is getting a little OT; sorry.)

-- 
Ian Ward Comfort <icomfort@stanford.edu>
Systems Team Lead, Academic Computing Services, Stanford University
Previous: Ævar Arnfjörð BjarmasonNext: Jeff King
Message 5 of 6 in “Put quotes around branch names to prevent special characters from being interpreted by the shell.”
  1. Put quotes around branch names to prevent special characters from being interpreted by the shell.Benjamin C Meyer, Jun 4, 2010
  2. Jeff KingJun 6, 2010
  3. Jay SoffianJun 7, 2010
  4. Ævar Arnfjörð BjarmasonJun 7, 2010
  5. Ian Ward ComfortJun 7, 2010
  6. Jeff KingJun 7, 2010

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.