##// END OF EJS Templates
upstream » mercurial-mirror
RSS

Clone from https://www.mercurial-scm.org/repo/hg-all

util: add utility method to check for bad ssh urls (SEC)...
util: add utility method to check for bad ssh urls (SEC) Our use of SSH has an exploit that will parse the first part of an url blindly as a hostname. Prior to this set of security patches, a url with '-oProxyCommand' could run arbitrary code on a user's machine. In addition, at least on Windows, a pipe '|' can be abused to execute arbitrary commands in a similar fashion. We defend against this by checking ssh:// URLs and looking for a hostname that starts with a - or contains a |. When this happens, let's throw a big abort into the user's face so that they can inspect what's going on.
Paul Boddie - - Load All Authors

File last commit:

r16773:d490edc7 default
r33706:53224b1f stable
Show More
graphedge.tmpl
1 line | 70 B | application/x-cheetah | CheetahLexer
/ mercurial / templates / raw / graphedge.tmpl
History | Source | Raw |Copy content |Copy permalink
Paul Boddie
hgweb: make graph data suitable for template usage...
 r16773 edge: ({col}, {row}) -> ({nextcol}, {nextrow}) (color {color})