Hello,
This is a request for input regarding a general solution to issue 1954
(http://subversion.tigris.org/issues/show_bug.cgi?id=1954).
1954 is about running svn_xml_is_xml_safe() on pathnames before
importing or adding them if they are not acceptable. A simple fix was to
add the check in libsvn_client/[commit.c and add.c], before adding the
pathname to the editor.
While testing the fix, I found out that Linux allows creation of
directories and files with control-characters in their names. The
problem now seems to be that Subversion doesn't support this, since an
un-encoded pathname can corrupt the entries file. Since Subversion
shouldn't limit the OS capabilities arbitrarily, Mike Pilato suggested
adding a base64 encode and decode at these points:
- writing to and reading from the entries file
- creating and parsing webDAV XML network requests/responses
The encoding/decoding process will be triggered only if the pathname
fails svn_xml_is_xml_safe(). For encoded paths, an attribute is then
recorded stating that the pathname has been encoded. Decoding takes
place only if that attribute exists.
Some issues:
cmpilato: there is still a danger here though, in that there are
certain webdav requests we don't "own"
cmpilato: meaning, the DAV spec defines "you shall format your XML
like so, and it shall validate against DTD foo."
cmpilato: in those cases, we can't encode. and for those operations,
folks might just be screwed.
- Windows doesn't seem to support such pathnames
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/base/naming_a_file.asp
but then Subversion supports symlinks while Windows doesn't.
Are there any other issues to consider before taking a stab at it?
Thanks
Sameer
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Wed Nov 24 07:02:03 2004