Re: [Qemu-devel] [PATCH] Add HTTP protocol using curl v2

[Anthony Liguori <anthony@codemonkey.ws>]

Kevin Wolf wrote:
> Anthony Liguori schrieb:
>   
>> I've changed my mind.  I think file: makes the situation worse because 
>> it gives a false sense of security.  If you just pass 
>> file:<user-inputed-filename> you are broken.  You still have to escape 
>> commas.  If you're escaping commas, you might as well escape colons too.
>>
>> I think escaping is the only complete solution.
>>     
>
> You're completely right if we don't limit the discussion to colons. I'm
> not sure if breaking colons really makes tools aware that they need to
> take care of commas, but "it's broken anyway" is a reasonable answer if
> we can have a generic fix (and we can have it here).
>   

If we have escaping, I'm happy to consider file: if people still think 
it's useful.  But adding file: without escaping is IMHO dangerous.

> So what should the generic escaping look like?
>   

-drive file=my-silly\:filename\,with\ strange\ characters

I see no reason to do anything overly complicated.  Of course, if you're 
in a shell, you'll have to double escape unless you've got single quotes 
around it.  That's a good argument for file: in addition to escaping.

Regards,

Anthony Liguori