From ce7ce69a4849caa3af34493a668e1f06068a3d82 Mon Sep 17 00:00:00 2001
From: Nathaniel Wesley Filardo <nwfilardo@gmail.com>
Date: Tue, 27 Dec 2022 02:55:03 +0000
Subject: [PATCH] Add additional escaping stress test

Thanks to https://github.com/jwilk/url.sh
---
 test-util.sh | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/test-util.sh b/test-util.sh
index 90af33a..c5dacdd 100755
--- a/test-util.sh
+++ b/test-util.sh
@@ -41,6 +41,12 @@ HERE
 HERE
 
 # Test the various shell escapes
+#
+# Full credit to https://github.com/jwilk/url.sh (MIT license) for the
+# example.com URL below.  That's nicely evil.  Note that we have had to escape
+# the dollar signs ourselves in the test input and outputs!  I'm not convinced
+# that the "human" version is doing very well on that example, but it's so
+# pathological that if you have file names like that you deserve what you get.
 ARB=$(echo "a\rb")
 cat >${LOG1} <<HERE
 a	b
@@ -51,9 +57,10 @@ x'
 🎶"
 α
 α'
+http://example.com/;'\$(gt=\$(perl\$IFS-E\$IFS's//62/;s/62/chr/e;say');eval\$IFS''cowsay\$IFS''pwned\$IFS\$gt/dev/tty)';cowsay\$IFS''pwned
 HERE
 
-${LUA} ./cdb-util escape posix <${LOG1} | diff -u /dev/fd/3 - 3<<HERE
+${LUA} ./cdb-util escape posix <${LOG1} | diff -au /dev/fd/3 - 3<<HERE
 'a	b'
 'a\$b'
 '${ARB}'
@@ -62,9 +69,10 @@ ${LUA} ./cdb-util escape posix <${LOG1} | diff -u /dev/fd/3 - 3<<HERE
 '🎶"'
 'α'
 'α'"'"''
+'http://example.com/;'"'"'\$(gt=\$(perl\$IFS-E\$IFS'"'"'s//62/;s/62/chr/e;say'"'"');eval\$IFS'"'"''"'"'cowsay\$IFS'"'"''"'"'pwned\$IFS\$gt/dev/tty)'"'"';cowsay\$IFS'"'"''"'"'pwned'
 HERE
 
-${LUA} ./cdb-util escape extended <${LOG1} | diff -u /dev/fd/3 - 3<<HERE
+${LUA} ./cdb-util escape extended <${LOG1} | diff -au /dev/fd/3 - 3<<HERE
 'a'\$'\\x09''b'
 'a\$b'
 'a'\$'\\x0d''b'
@@ -73,9 +81,10 @@ ${LUA} ./cdb-util escape extended <${LOG1} | diff -u /dev/fd/3 - 3<<HERE
 ''\$'\\xf0'''\$'\\x9f'''\$'\\x8e'''\$'\\xb6''"'
 ''\$'\\xce'''\$'\\xb1'''
 ''\$'\\xce'''\$'\\xb1'''"'"''
+'http://example.com/;'"'"'\$(gt=\$(perl\$IFS-E\$IFS'"'"'s//62/;s/62/chr/e;say'"'"');eval\$IFS'"'"''"'"'cowsay\$IFS'"'"''"'"'pwned\$IFS\$gt/dev/tty)'"'"';cowsay\$IFS'"'"''"'"'pwned'
 HERE
 
-${LUA} ./cdb-util escape human <${LOG1} | diff -u /dev/fd/3 - 3<<HERE
+${LUA} ./cdb-util escape human <${LOG1} | diff -au /dev/fd/3 - 3<<HERE
 'a'$'\\x09''b'
 'a\$b'
 'a'\$'\\x0d''b'
@@ -84,6 +93,7 @@ ${LUA} ./cdb-util escape human <${LOG1} | diff -u /dev/fd/3 - 3<<HERE
 '🎶"'
 'α'
 "α'"
+'http://example.com/;'"'"'\$(gt=\$(perl\$IFS-E\$IFS'"'"'s//62/;s/62/chr/e;say'"'"');eval\$IFS'"'"''"'"'cowsay\$IFS'"'"''"'"'pwned\$IFS\$gt/dev/tty)'"'"';cowsay\$IFS'"'"''"'"'pwned'
 HERE
 
 
-- 
2.50.1