Skip to content

wcurl: disable shell glob expansion#96

Merged
sergiodj merged 6 commits into
curl:mainfrom
arpitguptagithub:fix-glob-expansion
May 2, 2026
Merged

wcurl: disable shell glob expansion#96
sergiodj merged 6 commits into
curl:mainfrom
arpitguptagithub:fix-glob-expansion

Conversation

@arpitguptagithub

Copy link
Copy Markdown
Contributor

This PR disables shell glob expansion globally by changing set -eu to set -euf.

Why? because when i was using the wcurl, i noticed it has no reason to ever expand shell file globs like * or ?. By failing to disable globing, unquoted variables (such as $URLS inside exec_curl() and ${CURL_OPTIONS}) trigger pathname expansion against the current working directory.

For example,

Consider this,
wcurl 'example.com/file[1-3]' ..... currently fails by resolving local files and passing multiple incorrect strings to curl instead of the literal URL. The --globoff parameter passed to curl does not prevent the POSIX shell from expanding it first. Using set -f cleanly resolves this without side effects.

Added testing testGlobExpansion to tests.sh to ensure URLs with * are successfully passed to curl literally.

I would suggest adding contribution.MD, I followed the one with trurl, where i had committed before

@sergiodj sergiodj left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs a rebase, and I see the problem you're solving, but if I run your test without set -f on wcurl, I still see a pass:

$ ./tests/tests.sh 
testGlobExpansion
testUsage
testNoOptionError
testInvalidOptionError
testParallelIfMoreThanOneUrl
testEncodingWhitespace
testDoubleDash
testCurlOptions
testNextAmount
testUrlStartingWithDash
testOutputFileName
testOutputFileNameWithoutSpaces
testOutputFileNameRepeatedOption
testUrlDefaultName
testUrlDefaultNameTrailingSlash
testUrlDecodingWhitespace
testUrlDecodingWhitespaceTwoFiles
testUrlDecodingDisabled
testUrlDecodingWhitespaceQueryString
testUrlDecodingWhitespaceTrailingSlash
testUrlDecodingBackslashes
testUrlDecodingColon
testUrlEncodeColon
testUrlAllowColonWhenOutput
testUrlDecodingNonLatinLanguages
testFragmentStripping

Ran 26 tests.

We should adjust it to actually trigger the problem. In this case, I think the best way is to create a temporary directory named example.com with a few files insde, and then invoke wcurl inside $TMPDIR so that it actually performs path expansion.

Comment thread wcurl Outdated
Comment thread wcurl Outdated
Co-authored-by: Sergio Durigan Junior <[email protected]>
@arpitguptagithub
arpitguptagithub requested a review from sergiodj May 2, 2026 00:03

@sergiodj sergiodj left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@sergiodj
sergiodj merged commit 0efbc04 into curl:main May 2, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants