On Tue, Jan 27, 2015 at 10:14:50AM +0000, Daniel Shahaf wrote:
> [[[
> svn --version --verbose: Support /etc/os-release, the systemd "what distro
> am I running" API.
>
> * subversion/libsvn_subr/sysinfo.c
> (linux_release_name): Try /etc/os-release if /usr/bin/lsb_release fails.
> (systemd_release): New helper for linux_release_name().
> (remove_shell_quoting): New helper function.
> ]]]
>
> --- subversion/libsvn_subr/sysinfo.c
> +++ subversion/libsvn_subr/sysinfo.c
> @@ -410,6 +410,78 @@ lsb_release(apr_pool_t *pool)
> return NULL;
> }
>
> +/* Attempt to strip double quotes from a string.
> + *
> + * The string considered is (STR->DATA + OFFSET). If it starts
> + * and ends with double quotes, and has no escape sequences, return
> + * the string delimited by the double quotes. Otherwise, return
> + * the original string verbatim.
> + */
> +static const char *
> +remove_shell_quoting(svn_stringbuf_t *buf,
> + int offset,
> + apr_pool_t *result_pool)
> +{
> + const char *str = buf->data + offset;
> + const char *second_double_quote;
> +
Perhaps also trim leading and trailing whitespace before checking for quotes?
> + /* Are there exactly two double quotes, at the first and last positions? */
What about single quotes? The spec allows single quotes:
"Variable assignment values must be enclosed in double or single quotes if they
include spaces, semicolons or other special characters outside of A-Z, a-z, 0-9"
> + if (str[0] == '"' && (second_double_quote = strchr(str+1, '"'))
> + && second_double_quote[1] == '\0')
> + /* Are there any backslashes? */
> + if (!strchr(str, '\\'))
As I understand it backslashes used for escaping should be stripped so
that e.g. \$ becomes $ and \\ becomes \.
I'd suggest if we're going to go through the trouble of parsing quotes and
escapes it should be done properly. Alternatively we could just always use
the string verbatim.
> + /* Return whatever is between the quotes. */
> + return apr_pstrndup(result_pool, str+1, second_double_quote - (str+1));
> +
> + /* There are no double quotes, or there is a backslash and we punted.
> + * Either way, we'll return the string verbatim. */
> + return str;
> +}
Received on 2015-01-27 11:41:12 CET