##// END OF EJS Templates
hgweb: fix trust of templates path (BC)...
hgweb: fix trust of templates path (BC) Long ago we disabled trust of the templates path with a comment describing the (insecure) behavior before the change. At some later refactor, the code was apparently changed back to match the comment, unaware that the intent of the comment was to describe the behavior to avoid. This change disables the trust and updates the comment to explicitly say not only what the old problem was, but also that it was in fact a problem and the action taken to prevent it. Impact: prior to this change, if you had a UNIX-based hgweb server where users can write hgrc files, those users could potentially read any file readable by the web server. This is marked as a backwards compatibility issue because people may have configured templates without proper trust settings. Issue spotted by Greg Szorc.

File last commit:

r24634:4ece2847 default
r26120:1a45e49a 3.5.1 stable
Show More
parsers.py
110 lines | 3.2 KiB | text/x-python | PythonLexer
Martin Geisler
pure Python implementation of parsers.c
r7700 # parsers.py - Python implementation of parsers.c
#
# Copyright 2009 Matt Mackall <mpm@selenic.com> and others
#
Martin Geisler
updated license to be explicit about GPL version 2
r8225 # This software may be used and distributed according to the terms of the
Matt Mackall
Update license to GPLv2+
r10263 # GNU General Public License version 2 or any later version.
Martin Geisler
pure Python implementation of parsers.c
r7700
Matt Mackall
manifest: move pure parsing code out of pure...
r24215 from mercurial.node import nullid
Siddharth Agarwal
dirstate: move pure python dirstate packing to pure/parsers.py
r18567 import struct, zlib, cStringIO
Martin Geisler
pure Python implementation of parsers.c
r7700
_pack = struct.pack
_unpack = struct.unpack
_compress = zlib.compress
_decompress = zlib.decompress
Siddharth Agarwal
parsers: inline fields of dirstate values in C version...
r21809 # Some code below makes tuples directly because it's more convenient. However,
# code outside this module should always use dirstatetuple.
def dirstatetuple(*x):
# x is a tuple
return x
Matt Mackall
pure: update index parsing
r13261 def parse_index2(data, inline):
Matt Mackall
pure/parsers: fix circular imports, import mercurial modules properly
r7945 def gettype(q):
return int(q & 0xFFFF)
def offset_type(offset, type):
return long(long(offset) << 16 | type)
indexformatng = ">Qiiiiii20s12x"
Martin Geisler
pure Python implementation of parsers.c
r7700 s = struct.calcsize(indexformatng)
index = []
cache = None
py4fun
parsers: remove redundant 'n' variable in parsers.parse_index2() (issue2935)
r14995 off = 0
Matt Mackall
revlog: remove lazy index
r13253
Martin Geisler
pure Python implementation of parsers.c
r7700 l = len(data) - s
append = index.append
if inline:
cache = (0, data)
while off <= l:
e = _unpack(indexformatng, data[off:off + s])
append(e)
if e[1] < 0:
break
off += e[1] + s
else:
while off <= l:
e = _unpack(indexformatng, data[off:off + s])
append(e)
off += s
Augie Fackler
pure parsers: properly detect corrupt index files...
r14421 if off != len(data):
raise ValueError('corrupt index file')
Wagner Bruna
pure: fix index parsing on empty repositories
r13435 if index:
e = list(index[0])
type = gettype(e[0])
e[0] = offset_type(0, type)
index[0] = tuple(e)
Martin Geisler
pure Python implementation of parsers.c
r7700
# add the magic null revision at -1
index.append((0, 0, 0, -1, -1, -1, -1, nullid))
Matt Mackall
pure: update index parsing
r13261 return index, cache
Martin Geisler
pure Python implementation of parsers.c
r7700
def parse_dirstate(dmap, copymap, st):
parents = [st[:20], st[20: 40]]
Mads Kiilerich
fix wording and not-completely-trivial spelling errors and bad docstrings
r17425 # dereference fields so they will be local in loop
Matt Mackall
pure/parsers: fix circular imports, import mercurial modules properly
r7945 format = ">cllll"
e_size = struct.calcsize(format)
Martin Geisler
pure Python implementation of parsers.c
r7700 pos1 = 40
l = len(st)
# the inner loop
while pos1 < l:
pos2 = pos1 + e_size
e = _unpack(">cllll", st[pos1:pos2]) # a literal here is faster
pos1 = pos2 + e[4]
f = st[pos2:pos1]
if '\0' in f:
f, c = f.split('\0')
copymap[f] = c
dmap[f] = e[:4]
return parents
Siddharth Agarwal
dirstate: move pure python dirstate packing to pure/parsers.py
r18567
def pack_dirstate(dmap, copymap, pl, now):
now = int(now)
cs = cStringIO.StringIO()
write = cs.write
write("".join(pl))
for f, e in dmap.iteritems():
if e[0] == 'n' and e[3] == now:
# The file was last modified "simultaneously" with the current
# write to dirstate (i.e. within the same second for file-
# systems with a granularity of 1 sec). This commonly happens
# for at least a couple of files on 'update'.
# The user could change the file without changing its size
Siddharth Agarwal
pack_dirstate: only invalidate mtime for files written in the last second...
r19652 # within the same second. Invalidate the file's mtime in
Siddharth Agarwal
dirstate: move pure python dirstate packing to pure/parsers.py
r18567 # dirstate, forcing future 'status' calls to compare the
Siddharth Agarwal
pack_dirstate: only invalidate mtime for files written in the last second...
r19652 # contents of the file if the size is the same. This prevents
# mistakenly treating such files as clean.
Siddharth Agarwal
parsers: inline fields of dirstate values in C version...
r21809 e = dirstatetuple(e[0], e[1], e[2], -1)
Siddharth Agarwal
dirstate: move pure python dirstate packing to pure/parsers.py
r18567 dmap[f] = e
if f in copymap:
f = "%s\0%s" % (f, copymap[f])
e = _pack(">cllll", e[0], e[1], e[2], e[3], len(f))
write(e)
write(f)
return cs.getvalue()