Commit 5ffa8f05 authored by Robert Speicher's avatar Robert Speicher

Escape the query argument provided to `git grep` by `search_files`

Closes #14963.
parent 600b94cd
...@@ -795,7 +795,7 @@ class Repository ...@@ -795,7 +795,7 @@ class Repository
def search_files(query, ref) def search_files(query, ref)
offset = 2 offset = 2
args = %W(#{Gitlab.config.git.bin_path} grep -i -I -n --before-context #{offset} --after-context #{offset} -e #{query} #{ref || root_ref}) args = %W(#{Gitlab.config.git.bin_path} grep -i -I -n --before-context #{offset} --after-context #{offset} -e #{Regexp.escape(query)} #{ref || root_ref})
Gitlab::Popen.popen(args, path_to_repo).first.scrub.split(/^--$/) Gitlab::Popen.popen(args, path_to_repo).first.scrub.split(/^--$/)
end end
......
...@@ -94,6 +94,12 @@ describe Repository, models: true do ...@@ -94,6 +94,12 @@ describe Repository, models: true do
it { is_expected.to be_an Array } it { is_expected.to be_an Array }
it 'regex-escapes the query string' do
results = repository.search_files("test\\", 'master')
expect(results.first).not_to start_with('fatal:')
end
describe 'result' do describe 'result' do
subject { results.first } subject { results.first }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment