mercurial: protocol security updates.

- fixes Mercurial CVE for lack of permissions checking on mercurial batch commands
- more strict checks for permissions, now default to push instead of pull
to be always on safe side.
- decypher batch commands and pick top-most permission to be used

rhodecode/lib/middleware/simplehg.py

@@ -1,81 +1,152 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 SimpleHG middleware for handling mercurial protocol request
 (push/clone etc.). It's implemented with basic auth function
 """
 
 import logging
 import urlparse
+import urllib
 
 from rhodecode.lib import utils
 from rhodecode.lib.ext_json import json
 from rhodecode.lib.middleware import simplevcs
 
 log = logging.getLogger(__name__)
 
 
 class SimpleHg(simplevcs.SimpleVCS):
 
     SCM = 'hg'
 
     def _get_repository_name(self, environ):
         """
         Gets repository name out of PATH_INFO header
 
         :param environ: environ where PATH_INFO is stored
         """
         return environ['PATH_INFO'].strip('/')
 
     _ACTION_MAPPING = {
         'changegroup': 'pull',
         'changegroupsubset': 'pull',
         'getbundle': 'pull',
         'stream_out': 'pull',
         'listkeys': 'pull',
+        'between': 'pull',
+        'branchmap': 'pull',
+        'branches': 'pull',
+        'clonebundles': 'pull',
+        'capabilities': 'pull',
+        'debugwireargs': 'pull',
+        'heads': 'pull',
+        'lookup': 'pull',
+        'hello': 'pull',
+        'known': 'pull',
+
+        # largefiles
+        'putlfile': 'push',
+        'getlfile': 'pull',
+        'statlfile': 'pull',
+        'lheads': 'pull',
+
         'unbundle': 'push',
         'pushkey': 'push',
     }
 
+    @classmethod
+    def _get_xarg_headers(cls, environ):
+        i = 1
+        chunks = []  # gather chunks stored in multiple 'hgarg_N'
+        while True:
+            head = environ.get('HTTP_X_HGARG_{}'.format(i))
+            if not head:
+                break
+            i += 1
+            chunks.append(urllib.unquote_plus(head))
+        full_arg = ''.join(chunks)
+        pref = 'cmds='
+        if full_arg.startswith(pref):
+            # strip the cmds= header defining our batch commands
+            full_arg = full_arg[len(pref):]
+        cmds = full_arg.split(';')
+        return cmds
+
+    @classmethod
+    def _get_batch_cmd(cls, environ):
+        """
+        Handle batch command send commands. Those are ';' separated commands
+        sent by batch command that server needs to execute. We need to extract
+        those, and map them to our ACTION_MAPPING to get all push/pull commands
+        specified in the batch
+        """
+        default = 'push'
+        batch_cmds = []
+        try:
+            cmds = cls._get_xarg_headers(environ)
+            for pair in cmds:
+                parts = pair.split(' ', 1)
+                if len(parts) != 2:
+                    continue
+                # entry should be in a format `key ARGS`
+                cmd, args = parts
+                action = cls._ACTION_MAPPING.get(cmd, default)
+                batch_cmds.append(action)
+        except Exception:
+            log.exception('Failed to extract batch commands operations')
+
+        # in case we failed, (e.g malformed data) assume it's PUSH sub-command
+        # for safety
+        return batch_cmds or [default]
+
     def _get_action(self, environ):
         """
         Maps mercurial request commands into a pull or push command.
-        In case of unknown/unexpected data, it returns 'pull' to be safe.
+        In case of unknown/unexpected data, it returns 'push' to be safe.
 
         :param environ:
         """
+        default = 'push'
         query = urlparse.parse_qs(environ['QUERY_STRING'],
                                   keep_blank_values=True)
+
         if 'cmd' in query:
             cmd = query['cmd'][0]
-            return self._ACTION_MAPPING.get(cmd, 'pull')
+            if cmd == 'batch':
+                cmds = self._get_batch_cmd(environ)
+                if 'push' in cmds:
+                    return 'push'
+                else:
+                    return 'pull'
+            return self._ACTION_MAPPING.get(cmd, default)
 
-        return 'pull'
+        return default
 
     def _create_wsgi_app(self, repo_path, repo_name, config):
         return self.scm_app.create_hg_wsgi_app(
             repo_path, repo_name, config)
 
     def _create_config(self, extras, repo_name):
         config = utils.make_db_config(repo=repo_name)
         config.set('rhodecode', 'RC_SCM_DATA', json.dumps(extras))
 
         return config.serialize()

rhodecode/tests/lib/middleware/test_simplehg.py

@@ -1,125 +1,156 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import urlparse
 
 import mock
 import pytest
 import simplejson as json
 
 from rhodecode.lib.vcs.backends.base import Config
 from rhodecode.tests.lib.middleware import mock_scm_app
 import rhodecode.lib.middleware.simplehg as simplehg
 
 
 def get_environ(url):
     """Construct a minimum WSGI environ based on the URL."""
     parsed_url = urlparse.urlparse(url)
     environ = {
         'PATH_INFO': parsed_url.path,
         'QUERY_STRING': parsed_url.query,
     }
 
     return environ
 
 
 @pytest.mark.parametrize(
     'url, expected_action',
     [
         ('/foo/bar?cmd=unbundle&key=tip', 'push'),
         ('/foo/bar?cmd=pushkey&key=tip', 'push'),
         ('/foo/bar?cmd=listkeys&key=tip', 'pull'),
         ('/foo/bar?cmd=changegroup&key=tip', 'pull'),
-        # Edge case: unknown argument: assume pull
-        ('/foo/bar?cmd=unknown&key=tip', 'pull'),
-        ('/foo/bar?cmd=&key=tip', 'pull'),
+        ('/foo/bar?cmd=hello', 'pull'),
+        ('/foo/bar?cmd=batch', 'push'),
+        ('/foo/bar?cmd=putlfile', 'push'),
+        # Edge case: unknown argument: assume push
+        ('/foo/bar?cmd=unknown&key=tip', 'push'),
+        ('/foo/bar?cmd=&key=tip', 'push'),
         # Edge case: not cmd argument
-        ('/foo/bar?key=tip', 'pull'),
+        ('/foo/bar?key=tip', 'push'),
     ])
 def test_get_action(url, expected_action, request_stub):
     app = simplehg.SimpleHg(config={'auth_ret_code': '', 'base_path': ''},
                             registry=request_stub.registry)
     assert expected_action == app._get_action(get_environ(url))
 
 
 @pytest.mark.parametrize(
+    'environ, expected_xargs, expected_batch',
+    [
+        ({},
+         [''], ['push']),
+
+        ({'HTTP_X_HGARG_1': ''},
+         [''], ['push']),
+
+        ({'HTTP_X_HGARG_1': 'cmds=listkeys+namespace%3Dphases'},
+         ['listkeys namespace=phases'], ['pull']),
+
+        ({'HTTP_X_HGARG_1': 'cmds=pushkey+namespace%3Dbookmarks%2Ckey%3Dbm%2Cold%3D%2Cnew%3Dcb9a9f314b8b07ba71012fcdbc544b5a4d82ff5b'},
+         ['pushkey namespace=bookmarks,key=bm,old=,new=cb9a9f314b8b07ba71012fcdbc544b5a4d82ff5b'], ['push']),
+
+        ({'HTTP_X_HGARG_1': 'namespace=phases'},
+         ['namespace=phases'], ['push']),
+
+    ])
+def test_xarg_and_batch_commands(environ, expected_xargs, expected_batch):
+    app = simplehg.SimpleHg
+
+    result = app._get_xarg_headers(environ)
+    result_batch = app._get_batch_cmd(environ)
+    assert expected_xargs == result
+    assert expected_batch == result_batch
+
+
[e-mail](
     'url, expected_repo_name',
     [
         ('/foo?cmd=unbundle&key=tip', 'foo'),
         ('/foo/bar?cmd=pushkey&key=tip', 'foo/bar'),
         ('/foo/bar/baz?cmd=listkeys&key=tip', 'foo/bar/baz'),
         # Repos with trailing slashes.
         ('/foo/?cmd=unbundle&key=tip', 'foo'),
         ('/foo/bar/?cmd=pushkey&key=tip', 'foo/bar'),
         ('/foo/bar/baz/?cmd=listkeys&key=tip', 'foo/bar/baz'),
     ])
 def test_get_repository_name(url, expected_repo_name, request_stub):
     app = simplehg.SimpleHg(config={'auth_ret_code': '', 'base_path': ''},
                             registry=request_stub.registry)
     assert expected_repo_name == app._get_repository_name(get_environ(url))
 
 
 def test_get_config(user_util, baseapp, request_stub):
     repo = user_util.create_repo(repo_type='git')
     app = simplehg.SimpleHg(config={'auth_ret_code': '', 'base_path': ''},
                             registry=request_stub.registry)
     extras = [('foo', 'FOO', 'bar', 'BAR')]
 
     hg_config = app._create_config(extras, repo_name=repo.repo_name)
 
     config = simplehg.utils.make_db_config(repo=repo.repo_name)
     config.set('rhodecode', 'RC_SCM_DATA', json.dumps(extras))
     hg_config_org = config
 
     expected_config = [
         ('vcs_svn_tag', 'ff89f8c714d135d865f44b90e5413b88de19a55f', '/tags/*'),
         ('web', 'push_ssl', 'False'),
         ('web', 'allow_push', '*'),
         ('web', 'allow_archive', 'gz zip bz2'),
         ('web', 'baseurl', '/'),
         ('vcs_git_lfs', 'store_location', hg_config_org.get('vcs_git_lfs', 'store_location')),
         ('vcs_svn_branch', '9aac1a38c3b8a0cdc4ae0f960a5f83332bc4fa5e', '/branches/*'),
         ('vcs_svn_branch', 'c7e6a611c87da06529fd0dd733308481d67c71a8', '/trunk'),
         ('largefiles', 'usercache', hg_config_org.get('largefiles', 'usercache')),
         ('hooks', 'preoutgoing.pre_pull', 'python:vcsserver.hooks.pre_pull'),
         ('hooks', 'prechangegroup.pre_push', 'python:vcsserver.hooks.pre_push'),
         ('hooks', 'outgoing.pull_logger', 'python:vcsserver.hooks.log_pull_action'),
         ('hooks', 'pretxnchangegroup.pre_push', 'python:vcsserver.hooks.pre_push'),
         ('hooks', 'changegroup.push_logger', 'python:vcsserver.hooks.log_push_action'),
         ('hooks', 'changegroup.repo_size', 'python:vcsserver.hooks.repo_size'),
         ('phases', 'publish', 'True'),
         ('extensions', 'largefiles', ''),
         ('paths', '/', hg_config_org.get('paths', '/')),
         ('rhodecode', 'RC_SCM_DATA', '[["foo", "FOO", "bar", "BAR"]]')
     ]
     for entry in expected_config:
         assert entry in hg_config
 
 
 def test_create_wsgi_app_uses_scm_app_from_simplevcs(request_stub):
     config = {
         'auth_ret_code': '',
         'base_path': '',
         'vcs.scm_app_implementation':
             'rhodecode.tests.lib.middleware.mock_scm_app',
     }
     app = simplehg.SimpleHg(config=config, registry=request_stub.registry)
     wsgi_app = app._create_wsgi_app('/tmp/test', 'test_repo', {})
     assert wsgi_app is mock_scm_app.mock_hg_wsgi