The absence of -- in a command is usually a bug

In this case, a query like “HEAD grep=-V say 42” was failing. Not that
it is a sensible query, but it shouldn't fail like that.

Another possible solution is to use ‘-e’ (which expects a pattern in the
next argument), but it is slightly less explicit as I'm used to seeing
-- everywhere (and also assuming that there's a bug if I don't see it).

Author: AlexDaniel

Coverable.p6

@@ -131,8 +131,7 @@ method process($msg, $config is copy, $grep is copy, $code is copy) {
         $result = self.run-snippet: $full-commit, $filename;
         %*ENV<MVM_COVERAGE_LOG>:delete;
 
-        # TODO shell injection in $grep
-        my $g = run 'grep', '-P', $grep, $log, :out;
+        my $g = run 'grep', '-P', '--', $grep, $log, :out;
         my $s = run 'sort', '--key=2,2', '--key=3n', '-u', :in($g.out), :out;
         my $colrm = run 'colrm', 1, 5, :in($s.out), :out;
         $result<coverage> = $colrm.out.slurp-rest.chomp;

Greppable.p6

@@ -62,7 +62,7 @@ method process($msg) {
     my $result = self.get-output(|@git, ‘grep’,
                                  ‘--color=always’, ‘-z’, ‘-i’, ‘-I’,
                                  ‘--perl-regexp’, ‘--line-number’,
-                                 ‘-e’, $msg);
+                                 ‘--’, $msg);
 
     return ‘Sorry, can't do that’ if $result<exit-code> ≠ 0 & 1 or $result<signal> ≠ 0;
     return ‘Found nothing!’ unless $result<output>;