Auto merge of #5297 - bundler:seg-git-branch-hash, r=indirect

[GitProxy] Support branches containing shell metacharacters

Closes #5295

(cherry picked from commit 084cbc7)

lib/bundler/source/git/git_proxy.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+require "shellwords"
 require "tempfile"
 module Bundler
   class Source
@@ -180,7 +181,7 @@ def remove_cache
 
         def find_local_revision
           allowed_in_path do
-            git("rev-parse --verify #{ref}", true).strip
+            git("rev-parse --verify #{Shellwords.shellescape(ref)}", true).strip
           end
         end
 

spec/install/gemfile/git_spec.rb

@@ -209,6 +209,94 @@
     end
   end
 
+  describe "when specifying a branch" do
+    let(:branch) { "branch" }
+    let(:repo) { build_git("foo").path }
+    before(:each) do
+      update_git("foo", :path => repo, :branch => branch)
+    end
+
+    it "works" do
+      install_gemfile <<-G
+        git "#{repo}", :branch => #{branch.dump} do
+          gem "foo"
+        end
+      G
+
+      expect(the_bundle).to include_gems("foo 1.0")
+    end
+
+    context "when the branch starts with a `#`" do
+      let(:branch) { "#149/redirect-url-fragment" }
+      it "works" do
+        install_gemfile <<-G
+          git "#{repo}", :branch => #{branch.dump} do
+            gem "foo"
+          end
+        G
+
+        expect(the_bundle).to include_gems("foo 1.0")
+      end
+    end
+
+    context "when the branch includes quotes" do
+      let(:branch) { %('") }
+      it "works" do
+        install_gemfile <<-G
+          git "#{repo}", :branch => #{branch.dump} do
+            gem "foo"
+          end
+        G
+
+        expect(the_bundle).to include_gems("foo 1.0")
+      end
+    end
+  end
+
+  describe "when specifying a tag" do
+    let(:tag) { "tag" }
+    let(:repo) { build_git("foo").path }
+    before(:each) do
+      update_git("foo", :path => repo, :tag => tag)
+    end
+
+    it "works" do
+      install_gemfile <<-G
+        git "#{repo}", :tag => #{tag.dump} do
+          gem "foo"
+        end
+      G
+
+      expect(the_bundle).to include_gems("foo 1.0")
+    end
+
+    context "when the tag starts with a `#`" do
+      let(:tag) { "#149/redirect-url-fragment" }
+      it "works" do
+        install_gemfile <<-G
+          git "#{repo}", :tag => #{tag.dump} do
+            gem "foo"
+          end
+        G
+
+        expect(the_bundle).to include_gems("foo 1.0")
+      end
+    end
+
+    context "when the tag includes quotes" do
+      let(:tag) { %('") }
+      it "works" do
+        install_gemfile <<-G
+          git "#{repo}", :tag => #{tag.dump} do
+            gem "foo"
+          end
+        G
+
+        expect(the_bundle).to include_gems("foo 1.0")
+      end
+    end
+  end
+
   describe "when specifying local override" do
     it "uses the local repository instead of checking a new one out" do
       # We don't generate it because we actually don't need it

spec/support/builders.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 require "bundler/shared_helpers"
+require "shellwords"
 
 module Spec
   module Builders
@@ -664,14 +665,15 @@ def _build(options)
 
           if branch = options[:branch]
             raise "You can't specify `master` as the branch" if branch == "master"
+            escaped_branch = Shellwords.shellescape(branch)
 
-            if `git branch | grep #{branch}`.empty?
-              silently("git branch #{branch}")
+            if `git branch | grep #{escaped_branch}`.empty?
+              silently("git branch #{escaped_branch}")
             end
 
-            silently("git checkout #{branch}")
+            silently("git checkout #{escaped_branch}")
           elsif tag = options[:tag]
-            `git tag #{tag}`
+            `git tag #{Shellwords.shellescape(tag)}`
           elsif options[:remote]
             silently("git remote add origin file://#{options[:remote]}")
           elsif options[:push]