search

holygeek / git-number

Use numbers for dealing with files in git
ISC License
281 stars 25 forks source link

git-number should safely escape all arguments #33

Open pwagland opened 7 years ago

pwagland commented 7 years ago

Currently git-number has special handling for arguments with a ' ', '(' or ')' in the name. However there are many other characters that can cause problems, for example '"" or '\''.

When outputting the arguments for the command line, the %q type from printf should be used, as this will safely quote all parameters. https://stackoverflow.com/a/6306730/97627

Either that or pass in the arguments to system as parameters rather than as one big string. https://stackoverflow.com/a/3212171/97627

holygeek commented 7 years ago

This is definitely one of the trickiest part of handling the filenames. Single quotes are already supported so filename like Daisy's diary.txt is okay. Other special characters are not handled well. I would assume that for source codes, we don't have to worry about this issue as I would assume that these special characters are not that common in file names in a repository containing source code (for programming).

Handling these special characters correctly is definitely an improvement. I would very much welcome patches to do so.

pwagland commented 7 years ago

Well, FWIW, the problems that I have had in the past are not with filenames, but when trying to use gn commit. For example gn commit -m "Commit text" 1. That message can obviously be free-form, I kind of agree that having filenames with those characters is pretty unusual!