Skip to content

Commit 55d31e1

Browse files
author
Jay Conrod
committed
cmd/go: add '--' before repository names when invoking vcs tools
Also, in 'go get' in GOPATH mode, report an error for package paths that start with '-'. Change-Id: Ic2575381aa2d093ba15c53b893bf2eaded8b6066 Reviewed-on: https://go-review.googlesource.com/c/go/+/181237 Run-TryBot: Jay Conrod <jayconrod@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com>
1 parent b388d68 commit 55d31e1

File tree

6 files changed

+31
-23
lines changed

6 files changed

+31
-23
lines changed

‎src/cmd/go/internal/get/path.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,9 @@ func checkPath(path string, fileName bool) error {
4141
if path == "" {
4242
return fmt.Errorf("empty string")
4343
}
44+
if path[0] == '-' {
45+
return fmt.Errorf("leading dash")
46+
}
4447
if strings.Contains(path, "..") {
4548
return fmt.Errorf("double dot")
4649
}

‎src/cmd/go/internal/get/vcs.go

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ var vcsHg = &vcsCmd{
112112
name: "Mercurial",
113113
cmd: "hg",
114114

115-
createCmd: []string{"clone -U {repo} {dir}"},
115+
createCmd: []string{"clone -U -- {repo} {dir}"},
116116
downloadCmd: []string{"pull"},
117117

118118
// We allow both tag and branch names as 'tags'
@@ -128,7 +128,7 @@ var vcsHg = &vcsCmd{
128128
tagSyncDefault: []string{"update default"},
129129

130130
scheme: []string{"https", "http", "ssh"},
131-
pingCmd: "identify {scheme}://{repo}",
131+
pingCmd: "identify -- {scheme}://{repo}",
132132
remoteRepo: hgRemoteRepo,
133133
}
134134

@@ -145,7 +145,7 @@ var vcsGit = &vcsCmd{
145145
name: "Git",
146146
cmd: "git",
147147

148-
createCmd: []string{"clone {repo} {dir}", "-go-internal-cd {dir} submodule update --init --recursive"},
148+
createCmd: []string{"clone -- {repo} {dir}", "-go-internal-cd {dir} submodule update --init --recursive"},
149149
downloadCmd: []string{"pull --ff-only", "submodule update --init --recursive"},
150150

151151
tagCmd: []tagCmd{
@@ -165,7 +165,7 @@ var vcsGit = &vcsCmd{
165165
tagSyncDefault: []string{"submodule update --init --recursive"},
166166

167167
scheme: []string{"git", "https", "http", "git+ssh", "ssh"},
168-
pingCmd: "ls-remote {scheme}://{repo}",
168+
pingCmd: "ls-remote -- {scheme}://{repo}",
169169
remoteRepo: gitRemoteRepo,
170170
}
171171

@@ -222,7 +222,7 @@ var vcsBzr = &vcsCmd{
222222
name: "Bazaar",
223223
cmd: "bzr",
224224

225-
createCmd: []string{"branch {repo} {dir}"},
225+
createCmd: []string{"branch -- {repo} {dir}"},
226226

227227
// Without --overwrite bzr will not pull tags that changed.
228228
// Replace by --overwrite-tags after http://pad.lv/681792 goes in.
@@ -233,7 +233,7 @@ var vcsBzr = &vcsCmd{
233233
tagSyncDefault: []string{"update -r revno:-1"},
234234

235235
scheme: []string{"https", "http", "bzr", "bzr+ssh"},
236-
pingCmd: "info {scheme}://{repo}",
236+
pingCmd: "info -- {scheme}://{repo}",
237237
remoteRepo: bzrRemoteRepo,
238238
resolveRepo: bzrResolveRepo,
239239
}
@@ -284,14 +284,14 @@ var vcsSvn = &vcsCmd{
284284
name: "Subversion",
285285
cmd: "svn",
286286

287-
createCmd: []string{"checkout {repo} {dir}"},
287+
createCmd: []string{"checkout -- {repo} {dir}"},
288288
downloadCmd: []string{"update"},
289289

290290
// There is no tag command in subversion.
291291
// The branch information is all in the path names.
292292

293293
scheme: []string{"https", "http", "svn", "svn+ssh"},
294-
pingCmd: "info {scheme}://{repo}",
294+
pingCmd: "info -- {scheme}://{repo}",
295295
remoteRepo: svnRemoteRepo,
296296
}
297297

@@ -334,7 +334,7 @@ var vcsFossil = &vcsCmd{
334334
name: "Fossil",
335335
cmd: "fossil",
336336

337-
createCmd: []string{"-go-internal-mkdir {dir} clone {repo} " + filepath.Join("{dir}", fossilRepoName), "-go-internal-cd {dir} open .fossil"},
337+
createCmd: []string{"-go-internal-mkdir {dir} clone -- {repo} " + filepath.Join("{dir}", fossilRepoName), "-go-internal-cd {dir} open .fossil"},
338338
downloadCmd: []string{"up"},
339339

340340
tagCmd: []tagCmd{{"tag ls", `(.*)`}},

‎src/cmd/go/internal/modfetch/codehost/git.go

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ func newGitRepo(remote string, localOK bool) (Repo, error) {
8080
// but this lets us say git fetch origin instead, which
8181
// is a little nicer. More importantly, using a named remote
8282
// avoids a problem with Git LFS. See golang.org/issue/25605.
83-
if _, err := Run(r.dir, "git", "remote", "add", "origin", r.remote); err != nil {
83+
if _, err := Run(r.dir, "git", "remote", "add", "origin", "--", r.remote); err != nil {
8484
os.RemoveAll(r.dir)
8585
return nil, err
8686
}
@@ -123,8 +123,10 @@ type gitRepo struct {
123123
statCache par.Cache
124124

125125
refsOnce sync.Once
126-
refs map[string]string
127-
refsErr error
126+
// refs maps branch and tag refs (e.g., "HEAD", "refs/heads/master")
127+
// to commits (e.g., "37ffd2e798afde829a34e8955b716ab730b2a6d6")
128+
refs map[string]string
129+
refsErr error
128130

129131
localTagsOnce sync.Once
130132
localTags map[string]bool
@@ -407,7 +409,7 @@ func (r *gitRepo) fetchUnshallow(refSpecs ...string) error {
407409
// statLocal returns a RevInfo describing rev in the local git repository.
408410
// It uses version as info.Version.
409411
func (r *gitRepo) statLocal(version, rev string) (*RevInfo, error) {
410-
out, err := Run(r.dir, "git", "-c", "log.showsignature=false", "log", "-n1", "--format=format:%H %ct %D", rev)
412+
out, err := Run(r.dir, "git", "-c", "log.showsignature=false", "log", "-n1", "--format=format:%H %ct %D", rev, "--")
411413
if err != nil {
412414
return nil, fmt.Errorf("unknown revision %s", rev)
413415
}

‎src/cmd/go/internal/modfetch/codehost/vcs.go

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ var vcsCmds = map[string]*vcsCmd{
143143
"hg": {
144144
vcs: "hg",
145145
init: func(remote string) []string {
146-
return []string{"hg", "clone", "-U", remote, "."}
146+
return []string{"hg", "clone", "-U", "--", remote, "."}
147147
},
148148
tags: func(remote string) []string {
149149
return []string{"hg", "tags", "-q"}
@@ -168,36 +168,36 @@ var vcsCmds = map[string]*vcsCmd{
168168
if subdir != "" {
169169
pattern = []string{"-I", subdir + "/**"}
170170
}
171-
return str.StringList("hg", "archive", "-t", "zip", "--no-decode", "-r", rev, "--prefix=prefix/", pattern, target)
171+
return str.StringList("hg", "archive", "-t", "zip", "--no-decode", "-r", rev, "--prefix=prefix/", pattern, "--", target)
172172
},
173173
},
174174

175175
"svn": {
176176
vcs: "svn",
177177
init: nil, // no local checkout
178178
tags: func(remote string) []string {
179-
return []string{"svn", "list", strings.TrimSuffix(remote, "/trunk") + "/tags"}
179+
return []string{"svn", "list", "--", strings.TrimSuffix(remote, "/trunk") + "/tags"}
180180
},
181181
tagRE: re(`(?m)^(.*?)/?$`),
182182
statLocal: func(rev, remote string) []string {
183183
suffix := "@" + rev
184184
if rev == "latest" {
185185
suffix = ""
186186
}
187-
return []string{"svn", "log", "-l1", "--xml", remote + suffix}
187+
return []string{"svn", "log", "-l1", "--xml", "--", remote + suffix}
188188
},
189189
parseStat: svnParseStat,
190190
latest: "latest",
191191
readFile: func(rev, file, remote string) []string {
192-
return []string{"svn", "cat", remote + "/" + file + "@" + rev}
192+
return []string{"svn", "cat", "--", remote + "/" + file + "@" + rev}
193193
},
194194
// TODO: zip
195195
},
196196

197197
"bzr": {
198198
vcs: "bzr",
199199
init: func(remote string) []string {
200-
return []string{"bzr", "branch", "--use-existing-dir", remote, "."}
200+
return []string{"bzr", "branch", "--use-existing-dir", "--", remote, "."}
201201
},
202202
fetch: []string{
203203
"bzr", "pull", "--overwrite-tags",
@@ -220,14 +220,14 @@ var vcsCmds = map[string]*vcsCmd{
220220
if subdir != "" {
221221
extra = []string{"./" + subdir}
222222
}
223-
return str.StringList("bzr", "export", "--format=zip", "-r", rev, "--root=prefix/", target, extra)
223+
return str.StringList("bzr", "export", "--format=zip", "-r", rev, "--root=prefix/", "--", target, extra)
224224
},
225225
},
226226

227227
"fossil": {
228228
vcs: "fossil",
229229
init: func(remote string) []string {
230-
return []string{"fossil", "clone", remote, ".fossil"}
230+
return []string{"fossil", "clone", "--", remote, ".fossil"}
231231
},
232232
fetch: []string{"fossil", "pull", "-R", ".fossil"},
233233
tags: func(remote string) []string {
@@ -249,7 +249,7 @@ var vcsCmds = map[string]*vcsCmd{
249249
}
250250
// Note that vcsRepo.ReadZip below rewrites this command
251251
// to run in a different directory, to work around a fossil bug.
252-
return str.StringList("fossil", "zip", "-R", ".fossil", "--name", "prefix", extra, rev, target)
252+
return str.StringList("fossil", "zip", "-R", ".fossil", "--name", "prefix", extra, "--", rev, target)
253253
},
254254
},
255255
}

‎src/cmd/go/internal/module/module.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,9 @@ func checkPath(path string, fileName bool) error {
169169
if path == "" {
170170
return fmt.Errorf("empty string")
171171
}
172+
if path[0] == '-' {
173+
return fmt.Errorf("leading dash")
174+
}
172175
if strings.Contains(path, "..") {
173176
return fmt.Errorf("double dot")
174177
}

‎src/cmd/go/internal/module/module_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ var checkPathTests = []struct {
7979
{"/x.y/z", false, false, false},
8080
{"x./z", false, false, false},
8181
{".x/z", false, false, true},
82-
{"-x/z", false, true, true},
82+
{"-x/z", false, false, false},
8383
{"x..y/z", false, false, false},
8484
{"x.y/z/../../w", false, false, false},
8585
{"x.y//z", false, false, false},

0 commit comments

Comments
 (0)