From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <e@yhbt.net>
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net
X-Spam-Level: 
X-Spam-Status: No, score=-4.0 required=3.0 tests=ALL_TRUSTED,BAYES_00
	shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2
Received: from localhost (dcvr.yhbt.net [127.0.0.1])
	by dcvr.yhbt.net (Postfix) with ESMTP id 344C01F5AE
	for <meta@public-inbox.org>; Fri, 17 Jul 2020 06:07:10 +0000 (UTC)
From: Eric Wong <e@yhbt.net>
To: meta@public-inbox.org
Subject: [PATCH] config: reject `\n' in `inboxdir'
Date: Fri, 17 Jul 2020 06:07:10 +0000
Message-Id: <20200717060710.12672-1-e@yhbt.net>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
List-Id: <meta.public-inbox.org>

"\n" and other characters requiring quoting and/or escaping in
in $GIT_DIR/objects/info/alternates was not supported in git 2.11
and earlier; nor does it seem supported at all in libgit2.

This will allow us to support sharing git-cat-file or similar
endpoints across multiple inboxes via alternates.

This breaks an existing use case for anybody wacky
enough to put `\n' in the `inboxdir' pathname; but I doubt
this affects anybody.
---
 lib/PublicInbox/Config.pm |  5 ++++-
 script/public-inbox-init  |  1 +
 t/config.t                | 16 +++++++++++++---
 t/init.t                  |  8 ++++++++
 4 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/lib/PublicInbox/Config.pm b/lib/PublicInbox/Config.pm
index c0e2cc57..67199bb3 100644
--- a/lib/PublicInbox/Config.pm
+++ b/lib/PublicInbox/Config.pm
@@ -393,7 +393,10 @@ sub _fill {
 
 	# backwards compatibility:
 	$ibx->{inboxdir} //= $self->{"$pfx.mainrepo"};
-
+	if (($ibx->{inboxdir} // '') =~ /\n/s) {
+		warn "E: `$ibx->{inboxdir}' must not contain `\\n'\n";
+		return;
+	}
 	foreach my $k (qw(obfuscate)) {
 		my $v = $self->{"$pfx.$k"};
 		defined $v or next;
diff --git a/script/public-inbox-init b/script/public-inbox-init
index c7f3da6f..951338af 100755
--- a/script/public-inbox-init
+++ b/script/public-inbox-init
@@ -115,6 +115,7 @@ my $pfx = "publicinbox.$name";
 my @x = (qw/git config/, "--file=$pi_config_tmp");
 
 $inboxdir = abs_path($inboxdir);
+die "`\\n' not allowed in `$inboxdir'\n" if $inboxdir =~ /\n/s;
 if (-f "$inboxdir/inbox.lock") {
 	if (!defined $version) {
 		$version = 2;
diff --git a/t/config.t b/t/config.t
index ad543ad3..d7fd9446 100644
--- a/t/config.t
+++ b/t/config.t
@@ -10,13 +10,23 @@ my ($tmpdir, $for_destroy) = tmpdir();
 
 {
 	PublicInbox::Import::init_bare($tmpdir);
-	my @cmd = ('git', "--git-dir=$tmpdir", qw(config foo.bar), "hi\nhi");
+	my $inboxdir = "$tmpdir/new\nline";
+	my @cmd = ('git', "--git-dir=$tmpdir",
+		qw(config publicinbox.foo.inboxdir), $inboxdir);
 	is(xsys(@cmd), 0, "set config");
 
 	my $tmp = PublicInbox::Config->new("$tmpdir/config");
 
-	is("hi\nhi", $tmp->{"foo.bar"}, "config read correctly");
-	is("true", $tmp->{"core.bare"}, "used --bare repo");
+	is($tmp->{'publicinbox.foo.inboxdir'}, $inboxdir,
+		'config read correctly');
+	is($tmp->{'core.bare'}, 'true', 'init used --bare repo');
+
+	my @warn;
+	local $SIG{__WARN__} = sub { push @warn, @_ };
+	$tmp = PublicInbox::Config->new("$tmpdir/config");
+	is($tmp->lookup_name('foo'), undef, 'reject invalid inboxdir');
+	like("@warn", qr/^E:.*must not contain `\\n'/sm,
+		'warned about newline');
 }
 
 {
diff --git a/t/init.t b/t/init.t
index 5c021be7..b8f17b5c 100644
--- a/t/init.t
+++ b/t/init.t
@@ -49,6 +49,14 @@ sub quiet_fail {
 	ok(unlink("$cfgfile.lock"),
 		'-init did not unlink lock on failure');
 }
+{
+	my $rdr = { 2 => \(my $err = '') };
+	my $cmd = [ '-init', 'alist', "$tmpdir/a\nlist",
+		   qw(http://example.com/alist alist@example.com) ];
+	ok(!run_script($cmd, undef, $rdr),
+		'public-inbox-init rejects LF in inboxdir');
+	like($err, qr/`\\n' not allowed in `/s, 'reported \\n');
+}
 
 SKIP: {
 	require_mods(qw(DBD::SQLite Search::Xapian::WritableDatabase), 2);