From: Eli Zaretskii <eliz@gnu.org>
To: npostavs@users.sourceforge.net
Cc: p.stephani2@gmail.com, 20333@debbugs.gnu.org
Subject: bug#20333: 24.3; Add warning about shell quoting to documentation of combine-and-quote-strings
Date: Sun, 03 Jul 2016 18:34:13 +0300 [thread overview]
Message-ID: <83inwmrb0q.fsf@gnu.org> (raw)
In-Reply-To: <87bn2eg6no.fsf@users.sourceforge.net> (npostavs@users.sourceforge.net)
> From: npostavs@users.sourceforge.net
> Date: Sun, 03 Jul 2016 10:03:55 -0400
> Cc: 20333@debbugs.gnu.org
>
> >From 5a1d23231bcf3c279fd3b09654fb132513748e6c Mon Sep 17 00:00:00 2001
> From: Noam Postavsky <npostavs@gmail.com>
> Date: Sun, 3 Jul 2016 09:56:36 -0400
> Subject: [PATCH v1] Note combine-and-quote-strings doesn't shell quote
>
> * doc/lispref/processes.texi (Shell Arguments):
> * lisp/subr.el (combine-and-quote-strings): Add a note that
> combine-and-quote-strings doesn't protect arguments against shell
> evaluation (Bug #20333).
> ---
> doc/lispref/processes.texi | 5 +++++
> lisp/subr.el | 5 ++++-
> 2 files changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/doc/lispref/processes.texi b/doc/lispref/processes.texi
> index 5bd0b11..b4542f6 100644
> --- a/doc/lispref/processes.texi
> +++ b/doc/lispref/processes.texi
> @@ -215,6 +215,11 @@ Shell Arguments
> string arguments to be passed to @code{call-process} or
> @code{start-process}, or for converting such lists of arguments into
> a single Lisp string to be presented in the minibuffer or echo area.
> +Note that if a shell is involved (e.g., if using
> +@code{call-process-shell-command}), arguments should still be
> +protected by @code{shell-quote-argument};
> +@code{combine-and-quote-strings} is @emph{not} intended to protect
> +special characters from shell evaluation.
>
> @defun split-string-and-unquote string &optional separators
> This function splits @var{string} into substrings at matches for the
> diff --git a/lisp/subr.el b/lisp/subr.el
> index ed2166a..e9e19d3 100644
> --- a/lisp/subr.el
> +++ b/lisp/subr.el
> @@ -3706,7 +3706,10 @@ combine-and-quote-strings
> "Concatenate the STRINGS, adding the SEPARATOR (default \" \").
> This tries to quote the strings to avoid ambiguity such that
> (split-string-and-unquote (combine-and-quote-strings strs)) == strs
> -Only some SEPARATORs will work properly."
> +Only some SEPARATORs will work properly.
> +
> +Note that this is not intended to protect STRINGS from
> +interpretation by shells, use `shell-quote-argument' for that."
> (let* ((sep (or separator " "))
> (re (concat "[\\\"]" "\\|" (regexp-quote sep))))
> (mapconcat
> --
> 2.8.0
LGTM, thanks. This is good for emacs-25.
next prev parent reply other threads:[~2016-07-03 15:34 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-04-14 19:03 bug#20333: 24.3; Add warning about shell quoting to documentation of combine-and-quote-strings Philipp Stephani
2016-07-03 14:03 ` npostavs
2016-07-03 15:27 ` Philipp Stephani
2016-07-03 15:34 ` Eli Zaretskii [this message]
2016-07-03 19:08 ` npostavs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=83inwmrb0q.fsf@gnu.org \
--to=eliz@gnu.org \
--cc=20333@debbugs.gnu.org \
--cc=npostavs@users.sourceforge.net \
--cc=p.stephani2@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.