From: Stefan Sperling <stsp@stsp.name>
Subject: Re: dial fix for git-shell
To: Omar Polo <op@omarpolo.com>
Cc: gameoftrees@openbsd.org
Date: Sun, 19 Feb 2023 10:18:40 +0100

On Sat, Feb 18, 2023 at 05:15:38PM +0100, Omar Polo wrote:
> > diff f990756a3987ba6410baf611d561e9b8f285f047 b7785e3dc70cb13011efd95a48fa6d711a7e40e7
> > commit - f990756a3987ba6410baf611d561e9b8f285f047
> > commit + b7785e3dc70cb13011efd95a48fa6d711a7e40e7
> > blob - 3325c8994f55721d8588155cdc72b95d11fd2248
> > blob + ee259709c5574347c0f8cf0240d326da426a1ca1
> > --- lib/dial.c
> > +++ lib/dial.c
> > @@ -26,6 +26,7 @@
> >  #include <stdlib.h>
> >  #include <string.h>
> >  #include <unistd.h>
> > +#include <limits.h>
> >  
> >  #include "got_error.h"
> >  #include "got_path.h"
> > @@ -206,8 +207,8 @@ got_dial_ssh(pid_t *newpid, int *newfd, const char *ho
> >  {
> >  	const struct got_error *error = NULL;
> >  	int pid, pfd[2];
> > -	char cmd[64];
> > -	const char *argv[11];
> > +	char cmd[64 + PATH_MAX];
> > +	const char *argv[10];
> >  	int i = 0, j;
> >  
> >  	*newpid = -1;
> > @@ -228,7 +229,6 @@ got_dial_ssh(pid_t *newpid, int *newfd, const char *ho
> >  	argv[i++] = "--";
> >  	argv[i++] = (char *)host;
> >  	argv[i++] = (char *)cmd;
> > -	argv[i++] = (char *)path;
> >  	argv[i++] = NULL;
> >  	assert(i <= nitems(argv));
> >  
> > @@ -249,7 +249,8 @@ got_dial_ssh(pid_t *newpid, int *newfd, const char *ho
> >  			err(1, "dup2");
> >  		if (dup2(pfd[0], 1) == -1)
> >  			err(1, "dup2");
> > -		n = snprintf(cmd, sizeof(cmd), "git-%s-pack", direction);
> > +		n = snprintf(cmd, sizeof(cmd), "git-%s-pack '%s'",
> > +		    direction, path);
> 
> since we're apparently in the quoting business I guess we may need
> something more robust that handles paths with ' in them.
> 
> Maybe this is the reason git-shell is so picky.
> 
> could be even done as a separate step, fwiw ok op@ if you want to just
> commit this.

I will think some more about this. I really don't like having to deal
with quoting issues at this layer.