[PATCH] t5551: fix quoting in curl version bug prereq

[Jeff King <peff@peff.net>]

On Thu, Sep 24, 2026 at 08:53:49PM +0000, Johannes Schindelin via GitGitGadget wrote:

> +# The cURL version which Debian 12 ships (v7.88.1) can fail to retry
> +# authentication after an early HTTP/2 response. This bug was introduced
> +# in cURL v7.88.0 (8c762f5998 (http2: minor buffer and error path fixes,
> +# 2023-02-08)) and fixed in v8.3.0 (https://github.com/curl/curl/pull/11756).
> +test_lazy_prereq HAVE_CURL_HTTP2_BUG "
> +	test_have_prereq HTTP2 &&
> +	build_option libcurl |
> +	awk -F. '
> +		($1 == 7 && $2 >= 88) || ($1 == 8 && $2 < 3) { broken = 1 }
> +		END { exit !broken }
> +	'
> +"

Doh, this is totally broken. The prereq snippet is in double-quotes, so
the $1, etc in the awk invocation are interpolated before we even eval
it. Fix is below.

-- >8 --
Subject: [PATCH] t5551: fix quoting in curl version bug prereq

We have a prereq snippet that invokes awk. The awk script's $1, etc,
variables need to be quoted to avoid shell interpolation. We correctly
use a single-quote inside the prereq snippet, but the snippet itself is
contained in double-quotes. So we interpolate "$1" into whatever value
that happens to have in the outer shell, and eval nonsense like:

  awk '(--some-garbage == 7 && --other-garbage >= 88) ...'

As a result, we don't think we have a buggy curl version even when we
do, and run the test anyway. But of course it's easy not to notice,
since this prereq was protecting us from a racy bug. It only breaks
sometimes.

There are a few options for fixing the quoting:

  1. Backslash-escaping the dollar signs. This is perhaps the least-ugly
     version, but it's a minor hassle to remember if somebody touches
     the code later.

  2. Single-quote the snippet, then quote interior single-quotes as
     '\''. Reasonably obvious, but ugly.

  3. Use the '<<\EOT' here-doc trick to specify the snippet. This would
     look nice, but we don't yet support it for prereqs. ;)

This patch uses (2), and we can circle back to (3) to make it look nicer
later.

Signed-off-by: Jeff King <peff@peff.net>
---
This should go on top of js/ci-debian-12-http2-workaround.

Since I know we both used GPT to work on this, I was curious if this
slipped past it. Doesn't look like it from what I sent (which used
option 2 above). I wonder if your agent flipped it, or if you saw how
ugly it was and flipped it yourself. Not blaming, but it's just a funny
and interesting data point if a human second-guessing the AI output
introduced a bug.

 t/t5551-http-fetch-smart.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/t/t5551-http-fetch-smart.sh b/t/t5551-http-fetch-smart.sh
index f66d7ce7ac..cb681e644f 100755
--- a/t/t5551-http-fetch-smart.sh
+++ b/t/t5551-http-fetch-smart.sh
@@ -21,14 +21,14 @@ start_httpd
 # authentication after an early HTTP/2 response. This bug was introduced
 # in cURL v7.88.0 (8c762f5998 (http2: minor buffer and error path fixes,
 # 2023-02-08)) and fixed in v8.3.0 (https://github.com/curl/curl/pull/11756).
-test_lazy_prereq HAVE_CURL_HTTP2_BUG "
+test_lazy_prereq HAVE_CURL_HTTP2_BUG '
 	test_have_prereq HTTP2 &&
 	build_option libcurl |
-	awk -F. '
+	awk -F. '\''
 		($1 == 7 && $2 >= 88) || ($1 == 8 && $2 < 3) { broken = 1 }
 		END { exit !broken }
-	'
-"
+	'\''
+'
 
 test_expect_success HTTP2 'enable client-side http/2' '
 	git config --global http.version HTTP/2
-- 
2.56.0.399.g9e0ddc9b37