Rename --nul-output to --raw-output0, abort on string containing NUL
The option naming --nul-output was confusing, especially when we have a similar option for input stream in the future (--nul-input vs --null-input). Based on the observation of other command line tools, we rename the option to --raw-output0. We also drop the short option -0 to avoid confusion on introducing the NUL-delimited input option. Unlike the other command line tools outputting file names with NUL delimiter, jq deals with JSON, and its strings may contain NUL character. To protect users from the risk of injection attacks, we abort the program and print an error message before outputting strings including NUL character. Closes #2683.
This commit is contained in:
1 parent
13fbe98dff
commit
a1e791acf8
4 files changed
+41
-30
No files matched your search
+12
-4
@@ -165,12 +165,20 @@ cmp $d/out $d/expected
|
||||
printf "[1,2][3,4]\n" | $JQ -cs add > $d/out 2>&1
|
||||
cmp $d/out $d/expected
|
||||
|
||||
# Regression test for -0 / --nul-output
|
||||
# Regression test for --raw-output0
|
||||
printf "a\0b\0" > $d/expected
|
||||
printf '["a", "b"]' | $JQ -0 .[] > $d/out 2>&1
|
||||
cmp $d/out $d/expected
|
||||
printf '["a", "b"]' | $JQ --nul-output .[] > $d/out 2>&1
|
||||
printf '["a", "b"]' | $VALGRIND $Q $JQ --raw-output0 .[] > $d/out
|
||||
cmp $d/out $d/expected
|
||||
printf "a\0" > $d/expected
|
||||
if printf '["a", "c\\u0000d", "b"]' | $VALGRIND $Q $JQ --raw-output0 .[] > $d/out; then
|
||||
echo "Should exit error on string containing NUL with --raw-output0" 1>&2
|
||||
exit 1
|
||||
elif [ $? -ne 5 ]; then
|
||||
echo "Invalid error code" 1>&2
|
||||
exit 1
|
||||
else
|
||||
cmp $d/out $d/expected
|
||||
fi
|
||||
|
||||
## Test streaming parser
|
||||
|
||||
|
||||
Reference in new issue
Block a user