gitweb: quote commands properly when calling the shell

[Gitweb] / gitweb.perl

diff --git a/gitweb.perl b/gitweb.perl
index f8302b77e05eb895de81e82394aa7f80f93b3fa1fecf388ed2c2961322151560..c5a9e77d218d6c5edc074736f546e41ad3aae323d41f00a04c4e0cc2f74ff441 100755 (executable)
--- a/gitweb.perl
+++ b/gitweb.perl
@@ -378,7 +378,7 @@ if (-e $GITWEB_CONFIG) {
 }
 
 # version of the core git binary
-our $git_version = qx($GIT --version) =~ m/git version (.*)$/ ? $1 : "unknown";
+our $git_version = qx("$GIT" --version) =~ m/git version (.*)$/ ? $1 : "unknown";
 
 $projects_list ||= $projectroot;
 
@@ -1501,9 +1501,13 @@ sub git_cmd {
        return $GIT, '--git-dir='.$git_dir;
 }
 
-# returns path to the core git executable and the --git-dir parameter as string
-sub git_cmd_str {
-       return join(' ', git_cmd());
+# quote the given arguments for passing them to the shell
+# quote_command("command", "arg 1", "arg with ' and ! characters")
+# => "'command' 'arg 1' 'arg with '\'' and '\!' characters'"
+# Try to avoid using this function wherever possible.
+sub quote_command {
+       return join(' ',
+                   map( { my $a = $_; $a =~ s/(['!])/'\\$1'/g; "'$a'" } @_ ));
 }
 
 # get HEAD ref of given project as hash
@@ -4550,7 +4554,6 @@ sub git_snapshot {
                $hash = git_get_head_hash($project);
        }
 
-       my $git_command = git_cmd_str();
        my $name = $project;
        $name =~ s,([^/])/*\.git$,$1,;
        $name = basename($name);
@@ -4558,11 +4561,12 @@ sub git_snapshot {
        $name =~ s/\047/\047\\\047\047/g;
        my $cmd;
        $filename .= "-$hash$known_snapshot_formats{$format}{'suffix'}";
-       $cmd = "$git_command archive " .
-               "--format=$known_snapshot_formats{$format}{'format'} " .
-               "--prefix=\'$name\'/ $hash";
+       $cmd = quote_command(
+               git_cmd(), 'archive',
+               "--format=$known_snapshot_formats{$format}{'format'}",
+               "--prefix=$name/", $hash);
        if (exists $known_snapshot_formats{$format}{'compressor'}) {
-               $cmd .= ' | ' . join ' ', @{$known_snapshot_formats{$format}{'compressor'}};
+               $cmd .= ' | ' . quote_command(@{$known_snapshot_formats{$format}{'compressor'}});
        }
 
        print $cgi->header(
@@ -4775,8 +4779,8 @@ sub git_object {
        if ($hash || ($hash_base && !defined $file_name)) {
                my $object_id = $hash || $hash_base;
 
-               my $git_command = git_cmd_str();
-               open my $fd, "-|", "$git_command cat-file -t $object_id 2>/dev/null"
+               open my $fd, "-|", quote_command(
+                       git_cmd(), 'cat-file', '-t', $object_id) . ' 2> /dev/null'
                        or die_error('404 Not Found', "Object does not exist");
                $type = <$fd>;
                chomp $type;