From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 7664F158074 for ; Sun, 22 Jun 2025 10:57:42 +0000 (UTC) Received: from lists.gentoo.org (bobolink.gentoo.org [140.211.166.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (No client certificate requested) (Authenticated sender: relay-lists.gentoo.org@gentoo.org) by smtp.gentoo.org (Postfix) with ESMTPSA id 639CB34128E for ; Sun, 22 Jun 2025 10:57:42 +0000 (UTC) Received: from bobolink.gentoo.org (localhost [127.0.0.1]) by bobolink.gentoo.org (Postfix) with ESMTP id 69E46110533; Sun, 22 Jun 2025 10:57:30 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (No client certificate requested) by bobolink.gentoo.org (Postfix) with ESMTPS id 60791110533 for ; Sun, 22 Jun 2025 10:57:30 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id E395A341436 for ; Sun, 22 Jun 2025 10:57:29 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 90308282F for ; Sun, 22 Jun 2025 10:57:27 +0000 (UTC) From: "Sam James" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sam James" Message-ID: <1750589821.22007fd5afdbb644d43dfef73351bbc8d0c272e2.sam@gentoo> Subject: [gentoo-commits] proj/portage:master commit in: bin/ X-VCS-Repository: proj/portage X-VCS-Files: bin/emerge-webrsync X-VCS-Directories: bin/ X-VCS-Committer: sam X-VCS-Committer-Name: Sam James X-VCS-Revision: 22007fd5afdbb644d43dfef73351bbc8d0c272e2 X-VCS-Branch: master Date: Sun, 22 Jun 2025 10:57:27 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 0beafd56-c195-4ade-83ed-32423539a040 X-Archives-Hash: a3bad1efae4d5f9a4c0deb2cece0e3a1 commit: 22007fd5afdbb644d43dfef73351bbc8d0c272e2 Author: Kerin Millar plushkava net> AuthorDate: Sun Jun 22 05:30:34 2025 +0000 Commit: Sam James gentoo org> CommitDate: Sun Jun 22 10:57:01 2025 +0000 URL: https://gitweb.gentoo.org/proj/portage.git/commit/?id=22007fd5 emerge-webrsync: safely split the GENTOO_MIRRORS variable Presently, the do_snapshot() function iterates over the unquoted expansion of the 'GENTOO_MIRRORS' variable. Doing so runs the risk of performing pathname expansion on the resulting words. Address the issue by using read to safely separate the collected words into an array before iterating over its elements. Signed-off-by: Kerin Millar plushkava.net> Signed-off-by: Sam James gentoo.org> bin/emerge-webrsync | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/bin/emerge-webrsync b/bin/emerge-webrsync index 08eebcca46..fb7b01211d 100755 --- a/bin/emerge-webrsync +++ b/bin/emerge-webrsync @@ -453,8 +453,8 @@ sync_local() { do_snapshot() { local ignore_timestamp=$1 date=$2 local {repo,snapshot}_timestamp have_files signature unixtime digest mirror file + local -a tarballs mirrors local -A suffix_by - local -a tarballs suffix_by=([xzcat]=xz [bzcat]=bz2 [zcat]=gz) @@ -468,7 +468,9 @@ do_snapshot() { die "unable to locate any decompressors (xzcat, bzcat or zcat)" fi - for mirror in ${GENTOO_MIRRORS} ; do + read -rd '' -a mirrors <<<"${GENTOO_MIRRORS}" + + for mirror in "${mirrors[@]}"; do mirror=${mirror%/} einfo "Trying to retrieve ${date} snapshot from ${mirror} ..." for file in "${tarballs[@]}"; do