From mboxrd@z Thu Jan  1 00:00:00 1970
From: Ian Campbell <ian.campbell@citrix.com>
Subject: Re: [PATCH OSSTEST v7 01/15] TestSupport: Add helper to
 fetch a URL on a host
Date: Mon, 6 Jul 2015 16:03:21 +0100
Message-ID: <1436195001.25646.111.camel@citrix.com>
References: <1432734277.14664.229.camel@citrix.com>
	<1432734323-14128-1-git-send-email-ian.campbell@citrix.com>
	<21914.38199.776194.101851@mariner.uk.xensource.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
In-Reply-To: <21914.38199.776194.101851@mariner.uk.xensource.com>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Ian Jackson <Ian.Jackson@eu.citrix.com>
Cc: xen-devel@lists.xen.org
List-Id: xen-devel@lists.xenproject.org

On Mon, 2015-07-06 at 15:48 +0100, Ian Jackson wrote:
> Ian Campbell writes ("[PATCH OSSTEST v7 01/15] TestSupport: Add helper to fetch a URL on a host"):
> > Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
> > ---
> > v7: Quote $url and $path, switch to a heredoc to avoid resulting over
> >     long line
> ...
> 
> Last time I wrote:
> 
>   Do we care that this will break badly if the url contains shell
>   metacharacters ?  I think we may do.
> 
> but:
> 
> > +    $useproxy wget --progress=dot:mega -O \"$path\" \"$url\"
> 
> Did you try this with $path or $url containing $ or   or " or \ or ` or
> starting with - ?

No, I think I just hadn't thought very clearly enough about what you
meant.

> There are a fair few places in osstest where we're quite lax with this
> kind of thing, but (hopefully) only where the information definitely
> comes from the configuration (or some other trusted source).  A
> general helper like this ought to be robust against that kind of input
> (which may well mean failing, but it should not include potentially
> executing bits of the input or misinterpreting it as command line
> options to wget.
> 
> \Q may be of some help.

Really? I thought that escaped things at the Perl level, is that
sufficient for the shell stuff within the Perl too?

I suspect I just don't understand clearly enough what \Q actually does.

Ian.