Skip to content

Escape branch names in push instructions

Dominic Couture requested to merge dcouture-escape-branch-name-init into master

What does this MR do and why?

Related to #354932 (closed)

It was possible to setup a project with a default branch name that could cause trouble for someone who carelessly copy-pasted the push instructions. This MR escapes the branch name.

The backslash escapes aren't the prettiest but I felt like using shellescape for this edge case was better than building our custom logic that would quote the string.

Screenshots or screen recordings

With a default branch name of ;rm -rf /

Before (repro on .com)
image

After (GDK)
image

How to set up and validate locally

  1. Create a group
  2. Set the default branch name to something like ;rm -rf / or anything with shell special characters in Settings > Repository
  3. Create an empty project and observe the escaped special characters

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Dominic Couture

Merge request reports