Completely quote AppPath and CustomConf paths #12955

zeripath · 2020-09-27T14:15:05Z

zeripath commented

2020-09-27 14:15:05 +00:00

Properly handle spaces in AppPath and CustomConf within hooks and
authorized_keys. Unfortunately here we don't seem to be able to get away
with using go-shellquote as it appears that Windows doesn't play too
well with singlequote quoting - therefore we will avoid singlequote
quoting unless we absolutely cannot get away without it, e.g. \n or !.

Fix #10813

Signed-off-by: Andrew Thornton art27@cantab.net

Properly handle spaces in AppPath and CustomConf within hooks and authorized_keys. Unfortunately here we don't seem to be able to get away with using go-shellquote as it appears that Windows doesn't play too well with singlequote quoting - therefore we will avoid singlequote quoting unless we absolutely cannot get away without it, e.g. \n or !. Fix #10813 Signed-off-by: Andrew Thornton <art27@cantab.net>

techknowlogick reviewed 2020-09-28 19:22:36 +00:00

models/ssh_key.go

techknowlogick commented

2020-09-28 19:22:36 +00:00

I'm having some trouble with this line. I get why the paths need to be escaped, but this looks like it is double escaping things, and can't see why it would need that.

lafriks (Migrated from github.com) reviewed 2020-09-28 19:43:21 +00:00

models/ssh_key.go

lafriks (Migrated from github.com) commented

2020-09-28 19:43:21 +00:00

because command should be kept together as single value, imho

techknowlogick reviewed 2020-09-28 19:58:35 +00:00

models/ssh_key.go

techknowlogick commented

2020-09-28 19:58:35 +00:00

ah yes, I see now. As expected I was just a touch dense. Thanks :)

techknowlogick approved these changes 2020-09-28 19:58:46 +00:00

6543 (Migrated from github.com) reviewed 2020-09-28 21:00:37 +00:00

modules/util/shellquote_test.go

						
				@ -0,0 +23,4 @@

						}, {

							"Typical windows path with spaces - should get doublequote escaped",

							`C:\Program Files\Gitea v1.13 - I like lots of spaces\gitea`,

							`"C:\\Program Files\\Gitea v1.13 - I like lots of spaces\\gitea"`,

6543 (Migrated from github.com) commented

2020-09-28 21:00:37 +00:00

I think windows will handle \\ as \ if they are not after a : but can we escape better?

I think windows will handle `\\` as `\` if they are not after a `:` but can we escape better?

zeripath reviewed 2020-09-28 21:09:22 +00:00

modules/util/shellquote_test.go

						
				@ -0,0 +23,4 @@

						}, {

							"Typical windows path with spaces - should get doublequote escaped",

							`C:\Program Files\Gitea v1.13 - I like lots of spaces\gitea`,

							`"C:\\Program Files\\Gitea v1.13 - I like lots of spaces\\gitea"`,

zeripath commented

2020-09-28 21:09:22 +00:00

This code is only used in places where a reasonable shell is running - it's not trying to cope with the idiosyncrasies of cmd or powershell. It's sh, ash, dash, bash running on top of cygwin/mingw - which frankly is idiosyncratic enough.