From 54cb65b19757a15efda9fe29c8c864cbb28cdffe Mon Sep 17 00:00:00 2001 From: Craig Scott Date: Sat, 27 Jan 2024 11:47:09 +1100 Subject: ExternalProject: Prevent URL list-splitting on special characters If a URL contains special characters like parentheses and a few others, they would previously have caused a foreach() call that iterates over the URLs to parse those special characters as separate, unquoted arguments. They would then have effectively split the list of URLs at unexpected places. Prepare the arguments for the foreach() call by using use bracket syntax to robustly handle any URLs that do have unescaped special characters. Issue: #25148 --- Modules/ExternalProject.cmake | 8 ++++++++ Modules/ExternalProject/download.cmake.in | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/Modules/ExternalProject.cmake b/Modules/ExternalProject.cmake index d7af1bd..8b10135 100644 --- a/Modules/ExternalProject.cmake +++ b/Modules/ExternalProject.cmake @@ -1525,6 +1525,14 @@ function(_ep_write_downloadfile_script message(FATAL_ERROR "LOCAL can't be empty") endif() + # REMOTE could contain special characters that parse as separate arguments. + # Things like parentheses are legitimate characters in a URL, but would be + # seen as the start of a new unquoted argument by the cmake language parser. + # Avoid those special cases by preparing quoted strings for direct inclusion + # in the foreach() call that iterates over the set of URLs in REMOTE. + set(REMOTE "[====[${REMOTE}]====]") + string(REPLACE ";" "]====] [====[" REMOTE "${REMOTE}") + if(timeout) set(TIMEOUT_ARGS TIMEOUT ${timeout}) set(TIMEOUT_MSG "${timeout} seconds") diff --git a/Modules/ExternalProject/download.cmake.in b/Modules/ExternalProject/download.cmake.in index 261f782..0ad0dd3 100644 --- a/Modules/ExternalProject/download.cmake.in +++ b/Modules/ExternalProject/download.cmake.in @@ -107,7 +107,7 @@ foreach(i RANGE ${retry_number}) if(status_code IN_LIST download_retry_codes) sleep_before_download(${i}) endif() - foreach(url @REMOTE@) + foreach(url IN ITEMS @REMOTE@) if(NOT url IN_LIST skip_url_list) message(STATUS "Using src='${url}'") -- cgit v0.12