exec git命令拒绝重定向到Go中的文件

Question

I am trying to invoke a git log from go and redirect the output to a given file.

cmdArgs = []string{"log", "--numstat", "--reverse", fmt.Sprintf("%s..HEAD", "89c98f5ec48c8ac383ea9e27d792c3dc77fa6240"), `--pretty="format:=%P %H %an %ae %ad %at %s %b"`}

cmdArgs = append(cmdArgs, ">> "+workingDir+"/logs/"+repoName+".log && cat "+workingDir+"/logs/"+repoName+".log")

cmd := exec.Command("git", cmdArgs...)
cmd.Dir = workingDir + repoName

var out bytes.Buffer
var stderr bytes.Buffer
cmd.Stdout = &out
cmd.Stderr = &stderr
err := cmd.Run()
if err != nil {
    fmt.Println("git", strings.Join(cmdArgs, " "), "in", workingDir+repoName)
    fmt.Println(fmt.Sprint(err) + ": " + stderr.String())
    panic(err)
}

fails with

git log --numstat --reverse --pretty="format:=%P %H %an %ae %ad %at %s %b" 89c98f5ec48c8ac383ea9e27d792c3dc77fa6240..HEAD  > /someplace/xx-tmp.log && cat /someplace/xx-tmp.log in /someplace
exit status 128: fatal: ambiguous argument ' > /someplace/xx-tmp.log && cat /someplace/xx-tmp.log: unknown revision or path not in the working tree.
Use '--' to separate paths from revisions, like this:
'git <command> [<revision>...] -- [<file>...]'

Executing the command in bash directly poses no problem.

Answer 1

Go's cmd.Run() acts similarly to the C fork() and exec() process for starting a new program. This doesn't implicitly invoke a shell -- which is, from a security perspective, an extremely good thing; unnecessary shell invocation often leads to command injection vulnerabilities.

If you want capabilities that a shell can add -- here, redirection and compound command syntax -- but want to avoid the security risks, pass your data out-of-band from code:

cmdArgs = []string{
  "-c",                      // tells interpreter that script is next argument
  `outfile=$1; shift; "$@" >"$outfile" && cat "$outfile"`, // script to execute
  "_",                                                     // this is $0
  workingDir+"/logs/"+repoName+".log",                     // $1, becomes outfile
  "git", "log", "--numstat", "--reverse",                  // remaining args are in "$@"
  fmt.Sprintf("%s..HEAD", "89c98f5ec48c8ac383ea9e27d792c3dc77fa6240"),
  "--pretty=format:=%P %H %an %ae %ad %at %s %b"
}

cmd := exec.Command("sh", cmdArgs...)

The above is equivalent to the following shell script:

#!/bin/sh
#      ^^- not /bin/bash; this only guarantees support for POSIX syntax

outfile=$1                 # assign first positional argument to variable "$outfile"
shift                      # rename $2 to $1, $3 to $2, etc
if "$@" >"$outfile"; then  # run remaining arguments as a single command, stdout to outfile
  cat "$outfile"           # if that succeeded, then cat our "$outfile" to stdout
fi

Note that I removed the literal quotes from inside --pretty=. That's because when you run the command in a shell, those quotes are treated as syntax by the shell -- an instruction not to split on the spaces within the format string. Here, there is no shell parsing that string as code; if we left the quotes in, they would become a literal part of your format string.