upstream/mercurial-mirror Files · mercurial/node.py

subrepo: set GIT_ALLOW_PROTOCOL to limit git clone protocols (SEC)...

subrepo: set GIT_ALLOW_PROTOCOL to limit git clone protocols (SEC) CVE-2016-3068 (1/1) Git's git-remote-ext remote helper provides an ext:: URL scheme that allows running arbitrary shell commands. This feature allows implementing simple git smart transports with a single shell shell command. However, git submodules could clone arbitrary URLs specified in the .gitmodules file. This was reported as CVE-2015-7545 and fixed in git v2.6.1. However, if a user directly clones a malicious ext URL, the git client will still run arbitrary shell commands. Mercurial is similarly effected. Mercurial allows specifying git repositories as subrepositories. Git ext:: URLs can be specified as Mercurial subrepositories allowing arbitrary shell commands to be run on `hg clone ...`. The Mercurial community would like to thank Blake Burkhart for reporting this issue. The description of the issue is copied from Blake's report. This commit changes submodules to pass the GIT_ALLOW_PROTOCOL env variable to git commands with the same list of allowed protocols that git submodule is using. When the GIT_ALLOW_PROTOCOL env variable is already set, we just pass it to git without modifications.

Gregory Szorc - - Load All Authors

File last commit:

r28585:a3f3fdac default


                r28658:34d43cb8

stable

Download file

             node.py
        
                    26 lines
            
             | 667 B
            
                | text/x-python
            
             |
                PythonLexer
            
             / mercurial / node.py
          
                    History
                
                 |
                  Source
                 | Raw
                 |Copy content
                 |Copy permalink

        Martin Geisler
    
put license and copyright info into comment blocks

              r8226
            
      # node.py - basic nodeid manipulation for mercurial

      #

      # Copyright 2005, 2006 Matt Mackall <mpm@selenic.com>

      #

      # This software may be used and distributed according to the terms of the

        Matt Mackall
    
Update license to GPLv2+

              r10263
            
      # GNU General Public License version 2 or any later version.

        mpm@selenic.com
    
Break apart hg.py...

              r1089
            
        Gregory Szorc
    
node: use absolute_import

              r25962
            
      from __future__ import absolute_import

        Matt Mackall
    
Replace demandload with new demandimport

              r3877
            
      import binascii

        mpm@selenic.com
    
Break apart hg.py...

              r1089
            
        Siddharth Agarwal
    
node: add 'nullhex', hex-encoded nullid...

              r26980
            
      # This ugly style has a noticeable effect in manifest parsing

      hex = binascii.hexlify

      bin = binascii.unhexlify

        Thomas Arendsen Hein
    
Define and use nullrev (revision of nullid) instead of -1.

              r3578
            
      nullrev = -1

        mpm@selenic.com
    
Break apart hg.py...

              r1089
            
      nullid = "\0" * 20

        Siddharth Agarwal
    
node: add 'nullhex', hex-encoded nullid...

              r26980
            
      nullhex = hex(nullid)

        mpm@selenic.com
    
Break apart hg.py...

              r1089
            
        Yuya Nishihara
    
node: define experimental identifiers for working directory...

              r25737
            
      # pseudo identifiers for working directory

      # (they are experimental, so don't add too many dependencies on them)

      wdirrev = 0x7fffffff

      wdirid = "\xff" * 20

        mpm@selenic.com
    
Break apart hg.py...

              r1089
            
      def short(node):

          return hex(node[:6])

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

Martin Geisler put license and copyright info into comment blocks	r8226	# node.py - basic nodeid manipulation for mercurial
		#
		# Copyright 2005, 2006 Matt Mackall <mpm@selenic.com>
		#
		# This software may be used and distributed according to the terms of the
Matt Mackall Update license to GPLv2+	r10263	# GNU General Public License version 2 or any later version.
mpm@selenic.com Break apart hg.py...	r1089
Gregory Szorc node: use absolute_import	r25962	from __future__ import absolute_import

Matt Mackall Replace demandload with new demandimport	r3877	import binascii
mpm@selenic.com Break apart hg.py...	r1089
Siddharth Agarwal node: add 'nullhex', hex-encoded nullid...	r26980	# This ugly style has a noticeable effect in manifest parsing
		hex = binascii.hexlify
		bin = binascii.unhexlify

Thomas Arendsen Hein Define and use nullrev (revision of nullid) instead of -1.	r3578	nullrev = -1
mpm@selenic.com Break apart hg.py...	r1089	nullid = "\0" * 20
Siddharth Agarwal node: add 'nullhex', hex-encoded nullid...	r26980	nullhex = hex(nullid)
mpm@selenic.com Break apart hg.py...	r1089
Yuya Nishihara node: define experimental identifiers for working directory...	r25737	# pseudo identifiers for working directory
		# (they are experimental, so don't add too many dependencies on them)
		wdirrev = 0x7fffffff
		wdirid = "\xff" * 20

mpm@selenic.com Break apart hg.py...	r1089	def short(node):
		return hex(node[:6])