gentoo / cargo-ebuild

[MIRROR] cargo extension that can generate ebuilds using the in-tree eclasses
https://gitweb.gentoo.org/proj/cargo-ebuild.git
Apache License 2.0
33 stars 10 forks source link

`cargo ebuild` does not escape or sanitize DESCRIPTION #32

Open trofi opened 1 year ago

trofi commented 1 year ago

$ cargo ebuild on https://github.com/Michael-F-Bryan/mdbook-linkcheck generates among other things this snippet:

# ...
DESCRIPTION="A backend for `mdbook` which will check your links for you."
# ...

Note the mdbook. That at best fails sourcing:

$ pkgcheck scan .
app-text/mdbook-linkcheck
  SourcingError: version 0.7.7: failed sourcing ebuild: external commands disallowed during metadata regen: 'mdbook'

One of the options would be to drop suspicious characters, escape them or convert to something safer.

Thanks!