Re: [PATCH v2] t5510: replace 'origin' with URL more carefully (was Re: Test Failure t5510,t5562 - was RE: [ANNOUNCE] Git v2.37.0-rc1)

On Mon, Jun 20, 2022 at 06:20:07PM -0400, Derrick Stolee wrote:

Doesn't this introduce a new problem if $remote_url contains a tilde? Unlikely, but I thought the point of the exercise was defending against funny paths.

Getting this bullet-proof with sed is tricky, I think. I didn't follow all the other logic that that might need fixed, but handling this in perl is easy by passing the string on the command line, like:

  printf "%s" "$cmdline" |
  perl -pe '
    BEGIN { $url = shift }
    s[origin(?!/)]['\''$url'\'']g;
  ' "$remote_url"

For that matter, using printf and "perl -p" is a little silly, since we know there is only a single string to modify. Perhaps:

  perl -e '
    my ($cmdline, $url) = @ARGV;
    $cmdline =~ s[origin(?!/)]['\''$url'\'']g;
    print $cmdline;
  ' -- "$cmdline" "$remote_url"

And then further changes are easy:

  - you could replace the ad-hoc "I hope single quotes are enough"
    quoting of $url with a real regex

  - you can define $sq inside the perl script to avoid the gross '\''
    quoting (or even avoid it entirely with quotemeta)

So perhaps something like:

  perl -e '
    my ($cmdline, $url) = @ARGV;
    $cmdline =~ s[origin(?!/)][quotemeta($url)]ge;
    print $cmdline;
  ' -- "$cmdline" "$remote_url"

I don't mean to golf on this forever, but I wanted to show something concrete since you said you don't know perl well. I just think moving to sed introduces more opportunities for errors here, not fewer. :)

-Peff