Only allow strings as query terms and commands

Change-Id: I850978039ca10162a5ae2ab0a4f79374183107ba

2 files changed, 15 insertions, 13 deletions

diff --git a/pygerrit/client.py b/pygerrit/client.py
index 9f34ef8..6afb94d 100644
--- a/pygerrit/client.py
+++ b/pygerrit/client.py
@@ -50,19 +50,22 @@ class GerritClient(object):
         return self._ssh_client.get_remote_version()
 
     def query(self, term):
-        """ Run `gerrit query` with the given term.
+        """ Run `gerrit query` with the given `term`.
 
         Return a list of results as `Change` objects.
 
+        Raise `ValueError` if `term` is not a string.
+
         """
         results = []
         command = ["query", "--current-patch-set", "--all-approvals",
                    "--format JSON", "--commit-message"]
-        if isinstance(term, list):
-            command += [escape_string(" ".join(term))]
-        else:
-            command += [escape_string(term)]
-        result = self._ssh_client.run_gerrit_command(command)
+
+        if not isinstance(term, basestring):
+            raise ValueError("term must be a string")
+
+        command.append(escape_string(term))
+        result = self._ssh_client.run_gerrit_command(" ".join(command))
         decoder = JSONDecoder()
         for line in result.stdout.read().splitlines():
             # Gerrit's response to the query command contains one or more
diff --git a/pygerrit/ssh.py b/pygerrit/ssh.py
index adb3dd3..429ca27 100644
--- a/pygerrit/ssh.py
+++ b/pygerrit/ssh.py
@@ -140,16 +140,15 @@ class GerritSSHClient(SSHClient):
 
         Run `command` and return a `GerritSSHCommandResult`.
 
+        Raise `ValueError` if `command` is not a string.
+
         """
-        gerrit_command = ["gerrit"]
-        if isinstance(command, list):
-            gerrit_command += command
-        else:
-            gerrit_command.append(command)
+        if not isinstance(command, basestring):
+            raise ValueError("command must be a string")
+        gerrit_command = "gerrit " + command
 
         try:
-            c = " ".join(gerrit_command)
-            stdin, stdout, stderr = self.exec_command(c)
+            stdin, stdout, stderr = self.exec_command(gerrit_command)
         except SSHException as err:
             raise GerritError("Command execution error: %s" % err)
         return GerritSSHCommandResult(command, stdin, stdout, stderr)