osc add of directories does not quote the argument

[Vogtinator]

This makes it impossible to add directories with certain characters in the name and allows "fun" like this:

> mkdir ';sh #'
> osc add ';sh #'
;sh # is a directory, do you want to archive it for submission? (y/n) y
.
./;sh #
./.osc
./.osc/_meta
./.osc/_files
./.osc/_osclib_version
./.osc/_apiurl
./.osc/_package
./.osc/_project
sh-4.4$ 

[marcus-h]

On 2017-09-27 13:57:45 +0000, Fabian Vogt wrote: This makes it impossible to add directories with certain characters in the name and allows "fun" like this:

Thanks! Fixed in commit c9c0f8a.

[Vogtinator]

That commit is incomplete and does not protect at all. Injection with ' is still an issue:

> mkdir "'"';sh #'
> osc add "'"';sh #'
';sh # is a directory, do you want to archive it for submission? (y/n) y
find: '': No such file or directory
sh-4.4$

[marcus-h]

On 2017-09-27 23:47:18 -0700, Fabian Vogt wrote: That commit is incomplete and does not protect at all. Injection with `'` is still not an issue:

True. Now, it is really fixed with commits 63c2aa3 and dbdc712. Again, thanks for pointing this out!

[Vogtinator]

This is still not quite complete, now filenames that represent valid options to the command, like "--help":

> mkdir ./--help
> LANG=C osc add ./--help
--help is a directory, do you want to archive it for submission? (y/n) y
cpio: Usage: find [-H] [-L] [-P] [-Olevel] [-D help|tree|search|stat|rates|opt|exec] [path...] [expression]: Cannot stat: No such file or directory
cpio: blank line ignored
[...]

[marcus-h]

On 2017-09-28 18:24:18 +0000, Fabian Vogt wrote: This is still not quite complete, now filenames that represent valid options to the command, like "--help": ``` > mkdir ./--help > LANG=C osc add ./--help --help is a directory, do you want to archive it for submission? (y/n) y cpio: Usage: find [-H] [-L] [-P] [-Olevel] [-D help|tree|search|stat|rates|opt|exec] [path...] [expression]: Cannot stat: No such file or directory cpio: blank line ignored [...] ```

Thanks again! Finally (this time really;) ) fixed in commit c3ba1fb.

[Vogtinator]

Thanks again! Finally (this time really;) ) fixed in commit c3ba1fb.

Almost :P (Yes, extremely nitpicky now, but it is fun ;-) ):

> mkdir "$(echo -ne "dir\nname")"
> (cd dir*; touch file{1,2})
> osc add dir*
dir
name is a directory, do you want to archive it for submission? (y/n) y
cpio: dir: Cannot stat: No such file or directory
cpio: name/file1: Cannot stat: No such file or directory
cpio: dir: Cannot stat: No such file or directory
cpio: name/file2: Cannot stat: No such file or directory
1 block

The only characters not allowed in filenames are '\0' and '/', as / is a valid path only a 0 is a valid option, so I guess -0 should work?

[marcus-h]

On 2017-10-10 15:35:54 +0000, Fabian Vogt wrote: > Thanks again! Finally (this time really;) ) fixed in commit c3ba1fb. Almost :P (Yes, extremely nitpicky now, but it is fun ;-) ):

Yes, it is fun!:)

``` > mkdir "$(echo -ne "dir\nname")" > (cd dir*; touch file{1,2}) > osc add dir* dir name is a directory, do you want to archive it for submission? (y/n) y cpio: dir: Cannot stat: No such file or directory cpio: name/file1: Cannot stat: No such file or directory cpio: dir: Cannot stat: No such file or directory cpio: name/file2: Cannot stat: No such file or directory 1 block ``` The only characters not allowed in filenames are '\0' and '/', as / is a valid path only a 0 is a valid option, so I guess ```-0``` should work?

Hmm did you only check out commit c3ba1fb? This was already fixed in commit a5c7611.

[Vogtinator]

Hmm did you only check out commit c3ba1fb? This was already
fixed in commit a5c7611.

Ah, ok! I applied the diff that was linked here instead of cloning everything.
Now I really can't find anything wrong with the code anymore 👍