From: Junio C Hamano <gitster@pobox.com>
Date: Mon, 01 Jul 2019 22:28:45 GMT
Subject: Re: [PATCH v2 1/6] test-lib: introduce test_commit_bulk
Message-ID: <xmqq36jp5qzm.fsf@gitster-ct.c.googlers.com>
In-Reply-To: <20190629045322.GA8155@sigill.intra.peff.net>

Jeff King <peff@peff.net> writes:

>   - replace eval formatting magic with "%s" printf formatters (safer and
>     gets rid of quoting issues in the callers).

This one actually made me think twice about safety, as we'd be using
end-user supplied formatting string without any inspection.  I think
it is fine as it is merely a test helper.  

If somebody is later making it into a test-tool function, I expect
that our interpolation engine, not the bare sprintf(), would be used
there, and it would hopefully also be safe?

Thanks.