Conversation
github-project-automation
Bot
moved this to Todo
in Op-Amp Frequency Response and Applications Suite
Welcome to GitGitGadgetHi @anupamme, and welcome to GitGitGadget, the GitHub App to send patch series to the Git mailing list from GitHub Pull Requests. Please make sure that either:
You can CC potential reviewers by adding a footer to the PR description with the following syntax: NOTE: DO NOT copy/paste your CC list from a previous GGG PR's description, Also, it is a good idea to review the commit messages one last time, as the Git project expects them in a quite specific form:
It is in general a good idea to await the automated test ("Checks") in this Pull Request before contributing the patches, e.g. to avoid trivial issues such as unportable code. Contributing the patchesBefore you can contribute the patches, your GitHub username needs to be added to the list of permitted users. Any already-permitted user can do that, by adding a comment to your PR of the form Both the person who commented An alternative is the channel Once on the list of permitted usernames, you can contribute the patches to the Git mailing list by adding a PR comment If you want to see what email(s) would be sent for a After you submit, GitGitGadget will respond with another comment that contains the link to the cover letter mail in the Git mailing list archive. Please make sure to monitor the discussion in that thread and to address comments and suggestions (while the comments and suggestions will be mirrored into the PR by GitGitGadget, you will still want to reply via mail). If you do not want to subscribe to the Git mailing list just to be able to respond to a mail, you can download the mbox from the Git mailing list archive (click the curl -g --user "<EMailAddress>:<Password>" \
--url "imaps://imap.gmail.com/INBOX" -T /path/to/raw.txtTo iterate on your change, i.e. send a revised patch or patch series, you will first want to (force-)push to the same branch. You probably also want to modify your Pull Request description (or title). It is a good idea to summarize the revision by adding something like this to the cover letter (read: by editing the first comment on the PR, i.e. the PR description): To send a new iteration, just add another PR comment with the contents: Need help?New contributors who want advice are encouraged to join [email protected], where volunteers who regularly contribute to Git are willing to answer newbie questions, give advice, or otherwise provide mentoring to interested contributors. You must join in order to post or view messages, but anyone can join. You may also be able to find help in real time in the developer IRC channel, |
|
There is an issue in commit b45c880:
|
|
@anupamme with the current shape of this PR, I am not willing to Please understand that not only is the Git project highly critical of AI-generated contributions (you will need to polish it, manually, yourself, to at least give the impression that you had a hand in writing this patch), the project is also very particular in its requirements. See Again, I am unwilling to bless this PR with an |
b45c880 to
291728b
Compare
|
Review comments addressed. Pls review. |
@anupamme there are still test failures, e.g.: This is not a bug fix, this is introducing a new bug. |
|
@anupamme I'm not welcoming this back-and-forth. I'll not even look unless the CI build indicates no more test failures. |
291728b to
391e429
Compare
Apologies for the noise. All tests have passed now. Can you pls review again. |
|
@anupamme please edit #2411 (comment) extensively (it will be sent as a cover letter, so it should look a bit more like, say, https://lore.kernel.org/git/[email protected]/, the part before the shortlog, or like #1668 (comment), which made it into Git as 55702c5). You will want to tread very carefully around AI usage; There is at least one highly vocal voice on the Git mailing list who is very convinced that they speak for the project in trying to discourage each and every AI usage. It is usually more pleasant when one avoids triggering those responses while contributing to the Git project. |
|
/allow |
|
User anupamme is now allowed to use GitGitGadget. |
|
@anupamme I would like to recommend to add a sentence to the cover letter that you have read https://git-scm.com/docs/SubmittingPatches#ai and that this contribution is in compliance. That should (hopefully!) fend of unpleasantries. |
anupamme
changed the title
|
Hello, I've made the changes as requested. Pls review, and if there is still something to be done on my end, let me know. |
|
@anupamme almost perfect: Since you did not yet |
|
/preview |
|
Preview email sent as [email protected] |
|
/submit |
|
Submitted as [email protected] To fetch this version into To fetch this version to local tag |
|
Junio C Hamano wrote on the Git mailing list (how to reply to this email): "Anupam Mediratta via GitGitGadget" <[email protected]> writes:
> @@ -2279,7 +2290,7 @@ class P4Submit(Command, P4UserMap):
>
> if fixed_rcs_keywords:
> print("Retrying the patch with RCS keywords cleaned up")
> - if os.system(tryPatchCmd) == 0:
> + if diffTreeApply(id, tryPatchArgs) == 0:
> patch_succeeded = True
> print("Patch succeesed this time with RCS keywords cleaned")
Both of these check the result of running diff|apply pipeline and
react to a failure.
> @@ -2291,7 +2302,7 @@ class P4Submit(Command, P4UserMap):
> #
> # Apply the patch for real, and do add/delete/+x handling.
> #
> - system(applyPatchCmd, shell=True)
> + diffTreeApply(id, applyPatchArgs)
It is a bit hard to discover, but the original code catches a failed
"diff|apply" pipeline invocation, because the "system()" used here
is what git-p4.py defines for itself. When the pipeline fails, this
system() raises subprocess.CalledProcessError().
The new one ignores the exit status from the pipeline, so even after
a failure to apply the change, the program continues.
Which may not be what you want to see.
>
> for f in filesToChangeType:
> p4_edit(f, "-t", "auto")
> diff --git a/t/t9803-git-p4-shell-metachars.sh b/t/t9803-git-p4-shell-metachars.sh
> index 2913277013..ef8fd6e094 100755
> --- a/t/t9803-git-p4-shell-metachars.sh
> +++ b/t/t9803-git-p4-shell-metachars.sh
> @@ -105,4 +105,20 @@ test_expect_success 'branch with shell char' '
> )
> '
>
> +test_expect_success 'git p4 submit --commit does not execute shell metachars in commit id' '
> + git p4 clone --dest="$git" //depot &&
> + test_when_finished cleanup_git &&
> + (
> + cd "$git" &&
> + git config git-p4.skipSubmitEditCheck true &&
> + echo f3 >file3 &&
> + git add file3 &&
> + git commit -m "add file3" &&
> + name='"'"'$(touch${IFS}injection-marker)'"'"' &&
> + git branch "$name" HEAD &&
> + P4EDITOR="test-tool chmtime +5" git p4 submit --commit "$name"
> + ) &&
> + test_path_is_missing "$cli/injection-marker"
> +'
> +
> test_done
>
> base-commit: d38352cd43ab9745686d697872408bc3249a153f |
applyCommit() builds a `git diff-tree ... | git apply ...` pipeline as a shell command string, interpolating the commit id and running it via os.system()/system(shell=True). The id usually comes from `git rev-list` output (safe, plain SHA-1s), but it can also come verbatim from the user-supplied `--commit` option, which is never validated (git-p4.py:2620-2631). A value such as `$(some-command)` passed to `--commit` is executed by the shell during command substitution, even though the value is wrapped in double quotes. Replace the shell pipeline with two argument-vector subprocess calls connected directly through a pipe, matching the pattern already used throughout this file (read_pipe, read_pipe_lines, p4_system). This removes the shell entirely, rather than relying on quoting the interpolated value. The shell-based call that applied the patch for real went through git-p4.py's own system() helper, which raises CalledProcessError on a non-zero exit status, so a failed apply aborted the submit. Keep that behaviour by giving the new helper the same ignore_error contract system() uses: it raises unless the caller asks for the status, and the two callers that test the status for themselves ask for it. Add a regression test exercising `git p4 submit --commit` with a shell metacharacter payload, verifying it is never interpreted. Signed-off-by: Anupam Mediratta <[email protected]>
391e429 to
6fcacc7
Compare
|
/preview |
|
Preview email sent as [email protected] |
|
/submit |
|
Submitted as [email protected] To fetch this version into To fetch this version to local tag |
|
This patch series was integrated into seen via bf4b723. |
This branch has not been deployed
2 participants
P4Submit.applyCommit() builds a
git diff-tree | git applypipeline as a shellcommand string and runs it with os.system()/system(shell=True). The commit id
it interpolates is usually a plain SHA-1 from
git rev-list, but it can alsocome straight from the unvalidated
--commitcommand-line option, so a valuesuch as
$(some-command)passed to--commitgets executed by the shellduring command substitution.
This replaces the shell pipeline with two argument-vector subprocess calls
connected directly through a pipe, the same pattern already used everywhere
else in this file (read_pipe, read_pipe_lines, p4_system), so there's no shell
left to escape correctly. It also adds a regression test in t9803 that submits
a commit id crafted with shell metacharacters and checks they're never
executed.
I have read https://git-scm.com/docs/SubmittingPatches#ai and confirm this
contribution complies with it.
Changes since v1: as Junio pointed out, the call that applies the patch for
real used to go through git-p4.py's own system() helper, which raises
CalledProcessError on a non-zero exit status, so a failed
git applyabortedthe submit; v1 dropped that and silently carried on. The new helper now takes
the same ignore_error argument system() does and raises by default, and the two
callers that inspect the exit status themselves pass ignore_error=True.