alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity
Nix Packages collection
85671 commits 217 branches 121 tags 4.5 GiB
Nix 96.3%
Shell 1.6%
Python 1.1%
Perl 0.3%
C 0.2%
Other 0.1%
Find a file
aszlig df475092e9
lib: Make escapeShellArg more robust 
Quoting various characters that the shell *may* interpret specially is a
very fragile thing to do.

I've used something more robust all over the place in various Nix
expression I've written just because I didn't trust escapeShellArg.

Here is a proof of concept showing that I was indeed right in
distrusting escapeShellArg:

with import <nixpkgs> {};

let
  payload = runCommand "payload" {} ''
    # \x00 is not allowed for Nix strings, so let's begin at 1
    for i in $(seq 1 255); do
      echo -en "\\x$(printf %02x $i)"
    done > "$out"
  '';

  escapers = with lib; {
    current = escapeShellArg;
    better = arg: let
      backslashEscapes = stringToCharacters "\"\\ ';$`()|<>\r\t*[]&!~#";
      search = backslashEscapes ++ [ "\n" ];
      replace = map (c: "\\${c}") backslashEscapes ++ [ "'\n'" ];
    in replaceStrings search replace (toString arg);
    best = arg: "'${replaceStrings ["'"] ["'\\''"] (toString arg)}'";
  };

  testWith = escaper: let
    escaped = escaper (builtins.readFile payload);
  in runCommand "test" {} ''
    if ! r="$(bash -c ${escapers.best "echo -nE ${escaped}"} 2> /dev/null)"
    then
      echo bash eval error > "$out"
      exit 0
    fi
    if echo -n "$r" | cmp -s "${payload}"; then
      echo success > "$out"
    else
      echo failed > "$out"
    fi
  '';

in runCommand "results" {} ''
  echo "Test results:"
  ${lib.concatStrings (lib.mapAttrsToList (name: impl: ''
    echo "  ${name}: $(< "${testWith impl}")"
  '') escapers)}
  exit 1
''

The resulting output is the following:

Test results:
  best: success
  better: success
  current: bash eval error

I did the "better" implementation just to illustrate that the method of
quoting only "harmful" characters results in madness in terms of
implementation and performance.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @edolstra, @zimbatm
2016-06-20 23:53:36 +02:00
.github Update PR template with motivation for changes 2016-05-24 07:59:46 -04:00
doc haskell docs: now that hydra pushes directly to S3, it cant function as a binary cache 2016-06-18 21:14:33 -03:00
lib lib: Make escapeShellArg more robust 2016-06-20 23:53:36 +02:00
maintainers Fix evaluation error in Qt/KDE packages 2016-06-17 09:47:16 -05:00
nixos xl2tpd: add nixos module for service 2016-06-20 21:41:59 +01:00
pkgs Merge pull request #16370 from rasendubi/haskell-hoogle 2016-06-20 23:52:47 +02:00
.gitignore kde5: consolidate packages into desktops/kde-5 2016-03-01 10:36:00 -06:00
.mention-bot Blacklist jhasse 2016-03-05 23:23:19 +01:00
.travis.yml travis-ci: allow failures on osx until nixpkgs channel is unblocked 2016-06-03 12:08:24 +01:00
.version as always, no newline in .version 2016-02-28 23:39:38 +00:00
COPYING
default.nix Extract the top-level logic out of all-packages.nix into pkgs/top-level/default.nix 2016-03-20 16:28:18 +00:00
README.md README: 15.09 -> 16.03 2016-04-04 14:42:07 -04:00

README.md

logo

Build Status Issue Stats Issue Stats

Nixpkgs is a collection of packages for the Nix package manager. It is periodically built and tested by the hydra build daemon as so-called channels. To get channel information via git, add nixpkgs-channels as a remote:

% git remote add channels git://github.com/NixOS/nixpkgs-channels.git

For stability and maximum binary package support, it is recommended to maintain custom changes on top of one of the channels, e.g. nixos-16.03 for the latest release and nixos-unstable for the latest successful build of master:

% git remote update channels
% git rebase channels/nixos-16.03

For pull-requests, please rebase onto nixpkgs master.

NixOS linux distribution source code is located inside nixos/ folder.

Communication: