Skip to content

libdnf5: fix inappropriate backslash consumption in config files#2723

Open
Userfrom1995 wants to merge 1 commit into
rpm-software-management:mainfrom
Userfrom1995:compression
Open

libdnf5: fix inappropriate backslash consumption in config files#2723
Userfrom1995 wants to merge 1 commit into
rpm-software-management:mainfrom
Userfrom1995:compression

Conversation

@Userfrom1995

Copy link
Copy Markdown
Contributor

The variable substitution engine in libdnf5 was overly aggressive, unconditionally removing backslashes even when they preceded normal characters (e.g., 'M\y' became 'My').

This change restricts backslash de-escaping to only special characters:

  • '$' (to allow literal dollar signs)
  • '}' (to allow literal braces within subexpressions)

This ensures that backslashes in repository names and paths are preserved literally, matching the behavior of --setopt and restoring compatibility with user expectations from DNF4.

Added unit tests to verify the fix and prevent regressions.

Fixes: #2503

@Userfrom1995 Userfrom1995 requested a review from a team as a code owner May 2, 2026 20:58
@Userfrom1995 Userfrom1995 requested review from fhbash and removed request for a team May 2, 2026 20:58
@Userfrom1995 Userfrom1995 marked this pull request as draft May 3, 2026 07:03
@Userfrom1995

Copy link
Copy Markdown
Contributor Author

The CI failures are expected, as now we don't de-escape the double backslashes and they're passed as-is to printf, which is causing the issue. So the test stack needs updating, but before doing that I need confirmation from one of the reviewers that this is the way you guys want to go. Or maybe we can skip the vars.substitute() function for the command_format? That even sounds like a bad idea to me.

@Userfrom1995 Userfrom1995 marked this pull request as ready for review May 3, 2026 08:38
@ppisar

ppisar commented May 4, 2026

Copy link
Copy Markdown
Contributor

@jrohel, what is your opinion on this change?

@Userfrom1995

Copy link
Copy Markdown
Contributor Author

Could I get a review or any thoughts on this one?

The variable substitution engine in libdnf5 was overly aggressive,
unconditionally removing backslashes even when they preceded normal
characters (e.g., 'M\y' became 'My').

This change restricts backslash de-escaping to only special characters:
- '$' (to allow literal dollar signs)
- '}' (to allow literal braces within subexpressions)

This ensures that backslashes in repository names and paths are
preserved literally, matching the behavior of --setopt and restoring
compatibility with user expectations from DNF4.

Added unit tests to verify the fix and prevent regressions.

Fixes: rpm-software-management#2503
Assisted-by:  GLM-5.1
@Userfrom1995

Copy link
Copy Markdown
Contributor Author

Could I get a review or any thoughts on this one?

Another friendly ping for a review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

libdnf5: Backslashes '\' are inappropriately consumed/de-escaped when reading configuration files

2 participants