(CommandList
  children: [
    (Assignment
      keyword: Assign_None
      pairs: [
        (assign_pair
          lhs: (LhsName name:test_description)
          op: Equal
          rhs: {(SQ <'paths written by git-apply cannot escape the working tree'>)}
          spids: [4]
        )
      ]
      spids: [4]
    )
    (C {(.)} {(./test-lib.sh)})
    (C {(test_expect_success)} {(SQ <'bump git repo one level down'>)} 
      {(SQ <'\n'> <'\tmkdir inside &&\n'> <'\tmv .git inside/ &&\n'> <'\tcd inside\n'>)}
    )
    (FuncDef
      name: mkpatch_add
      body: 
        (BraceGroup
          children: [
            (AndOr
              ops: [Op_DAmp]
              children: [
                (C {(rm)} {(-f)} 
                  {
                    (DQ 
                      (BracedVarSub
                        token: <VSub_Number 2>
                        suffix_op: 
                          (StringUnary
                            op_id: VTest_ColonHyphen
                            arg_word: {($ VSub_Number '$1')}
                          )
                        spids: [56 60]
                      )
                    )
                  }
                )
                (SimpleCommand
                  words: [{(cat)}]
                  redirects: [
                    (HereDoc
                      op_id: Redir_DLessDash
                      fd: 16777215
                      body: 
                        {
                          (DQ ('diff --git a/') ($ VSub_Number '$1') (' b/') ($ VSub_Number '$1') ('\n') 
                            ('new file mode 100644\n') ('index 0000000..53c74cd\n') ('--- /dev/null\n') ('+++ b/') ($ VSub_Number '$1') ('\n') 
                            ('@@ -0,0 +1 @@\n') ('+evil\n')
                          )
                        }
                      do_expansion: True
                      here_end: EOF
                      was_filled: T
                      spids: [68]
                    )
                  ]
                )
              ]
            )
          ]
          spids: [48]
        )
      spids: [43 47]
    )
    (FuncDef
      name: mkpatch_del
      body: 
        (BraceGroup
          children: [
            (AndOr
              ops: [Op_DAmp]
              children: [
                (SimpleCommand
                  words: [{(echo)} {(evil)}]
                  redirects: [
                    (Redir
                      op_id: Redir_Great
                      fd: 16777215
                      arg_word: 
                        {
                          (DQ 
                            (BracedVarSub
                              token: <VSub_Number 2>
                              suffix_op: 
                                (StringUnary
                                  op_id: VTest_ColonHyphen
                                  arg_word: {($ VSub_Number '$1')}
                                )
                              spids: [102 106]
                            )
                          )
                        }
                      spids: [100]
                    )
                  ]
                )
                (SimpleCommand
                  words: [{(cat)}]
                  redirects: [
                    (HereDoc
                      op_id: Redir_DLessDash
                      fd: 16777215
                      body: 
                        {
                          (DQ ('diff --git a/') ($ VSub_Number '$1') (' b/') ($ VSub_Number '$1') ('\n') 
                            ('deleted file mode 100644\n') ('index 53c74cd..0000000\n') ('--- a/') ($ VSub_Number '$1') ('\n') ('+++ /dev/null\n') 
                            ('@@ -1 +0,0 @@\n') ('-evil\n')
                          )
                        }
                      do_expansion: True
                      here_end: EOF
                      was_filled: T
                      spids: [114]
                    )
                  ]
                )
              ]
            )
          ]
          spids: [93]
        )
      spids: [88 92]
    )
    (FuncDef
      name: mkpatch_symlink
      body: 
        (BraceGroup
          children: [
            (AndOr
              ops: [Op_DAmp]
              children: [
                (C {(rm)} {(-f)} {(DQ ($ VSub_Number '$1'))})
                (SimpleCommand
                  words: [{(cat)}]
                  redirects: [
                    (HereDoc
                      op_id: Redir_DLessDash
                      fd: 16777215
                      body: 
                        {
                          (DQ ('diff --git a/') ($ VSub_Number '$1') (' b/') ($ VSub_Number '$1') ('\n') 
                            ('new file mode 120000\n') ('index 0000000..') 
                            (CommandSubPart
                              command_list: 
                                (CommandList
                                  children: [
                                    (Pipeline
                                      children: [
                                        (C {(printf)} {(DQ ('%s'))} {(DQ ($ VSub_Number '$2'))})
                                        (C {(git)} {(hash-object)} {(--stdin)})
                                      ]
                                      negated: F
                                    )
                                  ]
                                )
                              left_token: <Left_CommandSub '$('>
                              spids: [171 189]
                            ) ('\n') ('--- /dev/null\n') ('+++ b/') ($ VSub_Number '$1') ('\n') ('@@ -0,0 +1 @@\n') ('+') 
                            ($ VSub_Number '$2') ('\n') (Lit_Other '\\') (' No newline at end of file\n')
                          )
                        }
                      do_expansion: True
                      here_end: EOF
                      was_filled: T
                      spids: [161]
                    )
                  ]
                )
              ]
            )
          ]
          spids: [145]
        )
      spids: [140 144]
    )
    (C {(test_expect_success)} {(SQ <'cannot create file containing ..'>)} 
      {
        (SQ <'\n'> <'\tmkpatch_add ../foo >patch &&\n'> <'\ttest_must_fail git apply patch &&\n'> 
          <'\ttest_path_is_missing ../foo\n'>
        )
      }
    )
    (C {(test_expect_success)} {(SQ <'can create file containing .. with --unsafe-paths'>)} 
      {
        (SQ <'\n'> <'\tmkpatch_add ../foo >patch &&\n'> <'\tgit apply --unsafe-paths patch &&\n'> 
          <'\ttest_path_is_file ../foo\n'>
        )
      }
    )
    (C {(test_expect_success)} {(SQ <'cannot create file containing .. (index)'>)} 
      {
        (SQ <'\n'> <'\tmkpatch_add ../foo >patch &&\n'> 
          <'\ttest_must_fail git apply --index patch &&\n'> <'\ttest_path_is_missing ../foo\n'>
        )
      }
    )
    (C {(test_expect_success)} {(SQ <'cannot create file containing .. with --unsafe-paths (index)'>)} 
      {
        (SQ <'\n'> <'\tmkpatch_add ../foo >patch &&\n'> 
          <'\ttest_must_fail git apply --index --unsafe-paths patch &&\n'> <'\ttest_path_is_missing ../foo\n'>
        )
      }
    )
    (C {(test_expect_success)} {(SQ <'cannot delete file containing ..'>)} 
      {
        (SQ <'\n'> <'\tmkpatch_del ../foo >patch &&\n'> <'\ttest_must_fail git apply patch &&\n'> 
          <'\ttest_path_is_file ../foo\n'>
        )
      }
    )
    (C {(test_expect_success)} {(SQ <'can delete file containing .. with --unsafe-paths'>)} 
      {
        (SQ <'\n'> <'\tmkpatch_del ../foo >patch &&\n'> <'\tgit apply --unsafe-paths patch &&\n'> 
          <'\ttest_path_is_missing ../foo\n'>
        )
      }
    )
    (C {(test_expect_success)} {(SQ <'cannot delete file containing .. (index)'>)} 
      {
        (SQ <'\n'> <'\tmkpatch_del ../foo >patch &&\n'> 
          <'\ttest_must_fail git apply --index patch &&\n'> <'\ttest_path_is_file ../foo\n'>
        )
      }
    )
    (C {(test_expect_success)} {(SYMLINKS)} {(SQ <'symlink escape via ..'>)} 
      {
        (SQ <'\n'> <'\t{\n'> <'\t\tmkpatch_symlink tmp .. &&\n'> <'\t\tmkpatch_add tmp/foo ../foo\n'> 
          <'\t} >patch &&\n'> <'\ttest_must_fail git apply patch &&\n'> <'\ttest_path_is_missing tmp &&\n'> 
          <'\ttest_path_is_missing ../foo\n'>
        )
      }
    )
    (C {(test_expect_success)} {(SYMLINKS)} {(SQ <'symlink escape via .. (index)'>)} 
      {
        (SQ <'\n'> <'\t{\n'> <'\t\tmkpatch_symlink tmp .. &&\n'> <'\t\tmkpatch_add tmp/foo ../foo\n'> 
          <'\t} >patch &&\n'> <'\ttest_must_fail git apply --index patch &&\n'> <'\ttest_path_is_missing tmp &&\n'> 
          <'\ttest_path_is_missing ../foo\n'>
        )
      }
    )
    (C {(test_expect_success)} {(SYMLINKS)} {(SQ <'symlink escape via absolute path'>)} 
      {
        (SQ <'\n'> <'\t{\n'> <'\t\tmkpatch_symlink tmp "$(pwd)" &&\n'> 
          <'\t\tmkpatch_add tmp/foo ../foo\n'> <'\t} >patch &&\n'> <'\ttest_must_fail git apply patch &&\n'> <'\ttest_path_is_missing tmp &&\n'> 
          <'\ttest_path_is_missing ../foo\n'>
        )
      }
    )
    (C {(test_expect_success)} {(SYMLINKS)} {(SQ <'symlink escape via absolute path (index)'>)} 
      {
        (SQ <'\n'> <'\t{\n'> <'\t\tmkpatch_symlink tmp "$(pwd)" &&\n'> 
          <'\t\tmkpatch_add tmp/foo ../foo\n'> <'\t} >patch &&\n'> <'\ttest_must_fail git apply --index patch &&\n'> 
          <'\ttest_path_is_missing tmp &&\n'> <'\ttest_path_is_missing ../foo\n'>
        )
      }
    )
    (C {(test_done)})
  ]
)