wcurl: disable shell glob expansion#96
Merged
Merged
Conversation
sergiodj
requested changes
May 1, 2026
Collaborator
There was a problem hiding this comment.
This needs a rebase, and I see the problem you're solving, but if I run your test without set -f on wcurl, I still see a pass:
$ ./tests/tests.sh
testGlobExpansion
testUsage
testNoOptionError
testInvalidOptionError
testParallelIfMoreThanOneUrl
testEncodingWhitespace
testDoubleDash
testCurlOptions
testNextAmount
testUrlStartingWithDash
testOutputFileName
testOutputFileNameWithoutSpaces
testOutputFileNameRepeatedOption
testUrlDefaultName
testUrlDefaultNameTrailingSlash
testUrlDecodingWhitespace
testUrlDecodingWhitespaceTwoFiles
testUrlDecodingDisabled
testUrlDecodingWhitespaceQueryString
testUrlDecodingWhitespaceTrailingSlash
testUrlDecodingBackslashes
testUrlDecodingColon
testUrlEncodeColon
testUrlAllowColonWhenOutput
testUrlDecodingNonLatinLanguages
testFragmentStripping
Ran 26 tests.
We should adjust it to actually trigger the problem. In this case, I think the best way is to create a temporary directory named example.com with a few files insde, and then invoke wcurl inside $TMPDIR so that it actually performs path expansion.
sergiodj
reviewed
May 1, 2026
sergiodj
requested changes
May 2, 2026
Co-authored-by: Sergio Durigan Junior <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR disables shell glob expansion globally by changing
set -eutoset -euf.Why? because when i was using the wcurl, i noticed it has no reason to ever expand shell file globs like
*or?. By failing to disable globing, unquoted variables (such as$URLSinsideexec_curl()and${CURL_OPTIONS}) trigger pathname expansion against the current working directory.For example,
Consider this,
wcurl 'example.com/file[1-3]'..... currently fails by resolving local files and passing multiple incorrect strings to curl instead of the literal URL. The--globoffparameter passed to curl does not prevent the POSIX shell from expanding it first. Usingset -fcleanly resolves this without side effects.Added testing
testGlobExpansiontotests.shto ensure URLs with*are successfully passed to curl literally.I would suggest adding contribution.MD, I followed the one with trurl, where i had committed before