mirror of
				https://gitee.com/gitea/gitea
				synced 2025-11-04 16:40:24 +08:00 
			
		
		
		
	Refactor git command arguments and make all arguments to be safe to be used (#21535)
Follow #21464 Make all git command arguments strictly safe. Most changes are one-to-one replacing, keep all existing logic.
This commit is contained in:
		@@ -35,7 +35,7 @@ func GetRawDiff(repo *Repository, commitID string, diffType RawDiffType, writer
 | 
			
		||||
// GetReverseRawDiff dumps the reverse diff results of repository in given commit ID to io.Writer.
 | 
			
		||||
func GetReverseRawDiff(ctx context.Context, repoPath, commitID string, writer io.Writer) error {
 | 
			
		||||
	stderr := new(bytes.Buffer)
 | 
			
		||||
	cmd := NewCommand(ctx, "show", "--pretty=format:revert %H%n", "-R", commitID)
 | 
			
		||||
	cmd := NewCommand(ctx, "show", "--pretty=format:revert %H%n", "-R").AddDynamicArguments(commitID)
 | 
			
		||||
	if err := cmd.Run(&RunOpts{
 | 
			
		||||
		Dir:    repoPath,
 | 
			
		||||
		Stdout: writer,
 | 
			
		||||
@@ -52,39 +52,38 @@ func GetRepoRawDiffForFile(repo *Repository, startCommit, endCommit string, diff
 | 
			
		||||
	if err != nil {
 | 
			
		||||
		return err
 | 
			
		||||
	}
 | 
			
		||||
	fileArgs := make([]string, 0)
 | 
			
		||||
	var files []string
 | 
			
		||||
	if len(file) > 0 {
 | 
			
		||||
		fileArgs = append(fileArgs, "--", file)
 | 
			
		||||
		files = append(files, file)
 | 
			
		||||
	}
 | 
			
		||||
 | 
			
		||||
	var args []string
 | 
			
		||||
	cmd := NewCommand(repo.Ctx)
 | 
			
		||||
	switch diffType {
 | 
			
		||||
	case RawDiffNormal:
 | 
			
		||||
		if len(startCommit) != 0 {
 | 
			
		||||
			args = append([]string{"diff", "-M", startCommit, endCommit}, fileArgs...)
 | 
			
		||||
			cmd.AddArguments("diff", "-M").AddDynamicArguments(startCommit, endCommit).AddDashesAndList(files...)
 | 
			
		||||
		} else if commit.ParentCount() == 0 {
 | 
			
		||||
			args = append([]string{"show", endCommit}, fileArgs...)
 | 
			
		||||
			cmd.AddArguments("show").AddDynamicArguments(endCommit).AddDashesAndList(files...)
 | 
			
		||||
		} else {
 | 
			
		||||
			c, _ := commit.Parent(0)
 | 
			
		||||
			args = append([]string{"diff", "-M", c.ID.String(), endCommit}, fileArgs...)
 | 
			
		||||
			cmd.AddArguments("diff", "-M").AddDynamicArguments(c.ID.String(), endCommit).AddDashesAndList(files...)
 | 
			
		||||
		}
 | 
			
		||||
	case RawDiffPatch:
 | 
			
		||||
		if len(startCommit) != 0 {
 | 
			
		||||
			query := fmt.Sprintf("%s...%s", endCommit, startCommit)
 | 
			
		||||
			args = append([]string{"format-patch", "--no-signature", "--stdout", "--root", query}, fileArgs...)
 | 
			
		||||
			cmd.AddArguments("format-patch", "--no-signature", "--stdout", "--root").AddDynamicArguments(query).AddDashesAndList(files...)
 | 
			
		||||
		} else if commit.ParentCount() == 0 {
 | 
			
		||||
			args = append([]string{"format-patch", "--no-signature", "--stdout", "--root", endCommit}, fileArgs...)
 | 
			
		||||
			cmd.AddArguments("format-patch", "--no-signature", "--stdout", "--root").AddDynamicArguments(endCommit).AddDashesAndList(files...)
 | 
			
		||||
		} else {
 | 
			
		||||
			c, _ := commit.Parent(0)
 | 
			
		||||
			query := fmt.Sprintf("%s...%s", endCommit, c.ID.String())
 | 
			
		||||
			args = append([]string{"format-patch", "--no-signature", "--stdout", query}, fileArgs...)
 | 
			
		||||
			cmd.AddArguments("format-patch", "--no-signature", "--stdout").AddDynamicArguments(query).AddDashesAndList(files...)
 | 
			
		||||
		}
 | 
			
		||||
	default:
 | 
			
		||||
		return fmt.Errorf("invalid diffType: %s", diffType)
 | 
			
		||||
	}
 | 
			
		||||
 | 
			
		||||
	stderr := new(bytes.Buffer)
 | 
			
		||||
	cmd := NewCommand(repo.Ctx, args...)
 | 
			
		||||
	if err = cmd.Run(&RunOpts{
 | 
			
		||||
		Dir:    repo.Path,
 | 
			
		||||
		Stdout: writer,
 | 
			
		||||
@@ -287,7 +286,7 @@ func GetAffectedFiles(repo *Repository, oldCommitID, newCommitID string, env []s
 | 
			
		||||
	affectedFiles := make([]string, 0, 32)
 | 
			
		||||
 | 
			
		||||
	// Run `git diff --name-only` to get the names of the changed files
 | 
			
		||||
	err = NewCommand(repo.Ctx, "diff", "--name-only", oldCommitID, newCommitID).
 | 
			
		||||
	err = NewCommand(repo.Ctx, "diff", "--name-only").AddDynamicArguments(oldCommitID, newCommitID).
 | 
			
		||||
		Run(&RunOpts{
 | 
			
		||||
			Env:    env,
 | 
			
		||||
			Dir:    repo.Path,
 | 
			
		||||
 
 | 
			
		||||
		Reference in New Issue
	
	Block a user