Skip to content

Conversation

@nrdxp
Copy link

@nrdxp nrdxp commented Dec 16, 2023

No description provided.

source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.4.0/direnvrc" "sha256-XQzUAvL6pysIJnRJyR7uVpmUSZfc7LSgWQwq/4mBr1U="
fi
nix_direnv_watch_file project.ncl nickel.lock.ncl
nix_direnv_watch_file project.ncl nickel.lock.ncl %{std.string.join " " direnv.watch_files}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't we escape the file names here, in all generality? For example:

let escape = std.string.replace "\"" "\\\"" in
let enclose = fun s => "\"%{s}\"" in
let extra_watch_files =
  direnv.watch_files
  |> std.array.map (fun s => s |> escape |> enclose)
  |> std.string.join " "
in
..
            nix_direnv_watch_file project.ncl nickel.lock.ncl extra_watch_files

Copy link
Author

@nrdxp nrdxp Dec 17, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm assuming this is for and other special characters? Perhaps we should use single quotes (') in the enclose function to also avoid arbitrary command expansions?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, ' is probably better (then we need to escape them instead of " in escape)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nrdxp are you still willing to apply this change? I think after that this PR is good to go!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants