On Mon, 2015-07-06 at 15:48 +0100, Ian Jackson wrote:
> Ian Campbell writes ("[PATCH OSSTEST v7 01/15] TestSupport: Add helper to
> fetch a URL on a host"):
> > Signed-off-by: Ian Campbell <ian.campb...@citrix.com>
> > ---
> > v7: Quote $url and $path, switch to a heredoc to avoid resulting over
> > long line
> ...
>
> Last time I wrote:
>
> Do we care that this will break badly if the url contains shell
> metacharacters ? I think we may do.
>
> but:
>
> > + $useproxy wget --progress=dot:mega -O \"$path\" \"$url\"
>
> Did you try this with $path or $url containing $ or or " or \ or ` or
> starting with - ?
No, I think I just hadn't thought very clearly enough about what you
meant.
> There are a fair few places in osstest where we're quite lax with this
> kind of thing, but (hopefully) only where the information definitely
> comes from the configuration (or some other trusted source). A
> general helper like this ought to be robust against that kind of input
> (which may well mean failing, but it should not include potentially
> executing bits of the input or misinterpreting it as command line
> options to wget.
>
> \Q may be of some help.
Really? I thought that escaped things at the Perl level, is that
sufficient for the shell stuff within the Perl too?
I suspect I just don't understand clearly enough what \Q actually does.
Ian.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
