Re: [Qemu-devel] [PATCH] Add HTTP protocol using curl v2

[Kevin Wolf]

Anthony Liguori schrieb:
> I've changed my mind.  I think file: makes the situation worse because 
> it gives a false sense of security.  If you just pass 
> file:<user-inputed-filename> you are broken.  You still have to escape 
> commas.  If you're escaping commas, you might as well escape colons too.
> 
> I think escaping is the only complete solution.

You're completely right if we don't limit the discussion to colons. I'm
not sure if breaking colons really makes tools aware that they need to
take care of commas, but "it's broken anyway" is a reasonable answer if
we can have a generic fix (and we can have it here).

So what should the generic escaping look like?

And I still think we should do something about colons, they are much
more common in paths than commas. Even more so on Windows, I guess.
Should we still implement the strategy "anything that isn't a valid
protocol must be a local file"?

Kevin