From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: X-Spam-Status: No, score=-4.0 required=3.0 tests=ALL_TRUSTED,AWL,BAYES_00 shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2 Received: from localhost (dcvr.yhbt.net [127.0.0.1]) by dcvr.yhbt.net (Postfix) with ESMTP id B057B1FA10 for ; Wed, 10 Nov 2021 10:28:37 +0000 (UTC) From: Eric Wong To: meta@public-inbox.org Subject: [PATCH 3/4] lei q: disallow "\n" in argv[] elements Date: Wed, 10 Nov 2021 10:28:37 +0000 Message-Id: <20211110102837.41770-1-e@80x24.org> In-Reply-To: <20211110102511.40960-1-e@80x24.org> References: <20211110102511.40960-1-e@80x24.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit List-Id: I don't expect this to be hit in real-world use via normal interactive shells. However, somebody could accidentally add "\n" in languages (e.g. Perl, C) where it's easy to pass "\n" in argv[]. --- lib/PublicInbox/LeiQuery.pm | 1 + t/lei.t | 3 +++ 2 files changed, 4 insertions(+) diff --git a/lib/PublicInbox/LeiQuery.pm b/lib/PublicInbox/LeiQuery.pm index 352ee60131aa..51ee3d9c83e4 100644 --- a/lib/PublicInbox/LeiQuery.pm +++ b/lib/PublicInbox/LeiQuery.pm @@ -141,6 +141,7 @@ no query allowed on command-line with --stdin PublicInbox::InputPipe::consume($self->{0}, \&qstr_add, $self); return; } + chomp(@argv) and $self->qerr("# trailing `\\n' removed"); $mset_opt{q_raw} = [ @argv ]; # copy $mset_opt{qstr} = $self->{lse}->query_argv_to_string($self->{lse}->git, \@argv); diff --git a/t/lei.t b/t/lei.t index f7de1b711a83..b10c9b59c72b 100644 --- a/t/lei.t +++ b/t/lei.t @@ -143,6 +143,9 @@ my $test_fail = sub { lei('-C', '/dev/null', 'q', 'whatever'); is($? >> 8, 1, 'chdir at beginning fails to /dev/null'); + lei_ok('q', "foo\n"); + like($lei_err, qr/trailing `\\n' removed/s, "noted `\\n' removal"); + for my $lk (qw(ei inbox)) { my $d = "$home/newline\n$lk"; mkdir $d;