Re: [PATCH v2] t5510: replace 'origin' with URL more carefully (was Re: Test Failure t5510,t5562 - was RE: [ANNOUNCE] Git v2.37.0-rc1)

[Jeff King <peff@peff.net>]

On Mon, Jun 20, 2022 at 06:20:07PM -0400, Derrick Stolee wrote:

> diff --git a/t/t5510-fetch.sh b/t/t5510-fetch.sh
> index 4620f0ca7fa..c255a77e18a 100755
> --- a/t/t5510-fetch.sh
> +++ b/t/t5510-fetch.sh
> @@ -853,7 +853,9 @@ test_configured_prune_type () {
>  		then
>  			new_cmdline=$cmdline_setup
>  		else
> -			new_cmdline=$(printf "%s" "$cmdline" | perl -pe 's[origin(?!/)]["'"$remote_url"'"]g')
> +			new_cmdline=$(printf "%s" "$cmdline" |
> +					sed -e "s~origin ~'$remote_url' ~g" \
> +					    -e "s~ origin~ '$remote_url'~g")
>  		fi

Doesn't this introduce a new problem if $remote_url contains a tilde?
Unlikely, but I thought the point of the exercise was defending against
funny paths.

Getting this bullet-proof with sed is tricky, I think. I didn't follow
all the other logic that that might need fixed, but handling this in
perl is easy by passing the string on the command line, like:

  printf "%s" "$cmdline" |
  perl -pe '
    BEGIN { $url = shift }
    s[origin(?!/)]['\''$url'\'']g;
  ' "$remote_url"

For that matter, using printf and "perl -p" is a little silly, since we
know there is only a single string to modify. Perhaps:

  perl -e '
    my ($cmdline, $url) = @ARGV;
    $cmdline =~ s[origin(?!/)]['\''$url'\'']g;
    print $cmdline;
  ' -- "$cmdline" "$remote_url"

And then further changes are easy:

  - you could replace the ad-hoc "I hope single quotes are enough"
    quoting of $url with a real regex

  - you can define $sq inside the perl script to avoid the gross '\''
    quoting (or even avoid it entirely with quotemeta)

So perhaps something like:

  perl -e '
    my ($cmdline, $url) = @ARGV;
    $cmdline =~ s[origin(?!/)][quotemeta($url)]ge;
    print $cmdline;
  ' -- "$cmdline" "$remote_url"

I don't mean to golf on this forever, but I wanted to show something
concrete since you said you don't know perl well. I just think moving to
sed introduces more opportunities for errors here, not fewer. :)

-Peff