fix: handle git branch name with special chars correctly (#39483)

Fix the bugs:
* Commit graph page doesn't show
* PR command line instructions are wrong

---------

Co-authored-by: silverwind <me@silverwind.io>

modules/util/shellquote.go

@@ -36,6 +36,7 @@ import "strings"
 
 const (
 	tildePrefix      = '~'
+	commentPrefix    = '#'
 	needsEscape      = " \t\n|&;()<>${}[]*?!\"'`\\"
 	needsSingleQuote = "!\n"
 )
@@ -74,7 +75,7 @@ func ShellEscape(toEscape string) string {
 	}
 
 	// Now for simplicity we'll look at the rest of the string
-	if !strings.ContainsAny(toEscape[start:], needsEscape) {
+	if !strings.ContainsAny(toEscape[start:], needsEscape) && toEscape[0] != commentPrefix {
 		return toEscape
 	}
 

modules/util/shellquote_test.go

@@ -75,6 +75,10 @@ func TestShellEscape(t *testing.T) {
 			"Double quote and escape `...",
 			"~/gitea`",
 			"~/\"gitea\\`\"",
+		}, {
+			"Double quote leading #",
+			"#123",
+			`"#123"`,
 		}, {
 			"Double quotes can handle a number of things without having to escape them but not everything ...",
 			"~/<gitea> ${gitea} `gitea` [gitea] (gitea) \"gitea\" \\gitea\\ 'gitea'",