upstream/mercurial-mirror Files · tests/test-mac-packages.t

dispatch: protect against malicious 'hg serve --stdio' invocations (sec)...

dispatch: protect against malicious 'hg serve --stdio' invocations (sec) Some shared-ssh installations assume that 'hg serve --stdio' is a safe command to run for minimally trusted users. Unfortunately, the messy implementation of argument parsing here meant that trying to access a repo named '--debugger' would give the user a pdb prompt, thereby sidestepping any hoped-for sandboxing. Serving repositories over HTTP(S) is unaffected. We're not currently hardening any subcommands other than 'serve'. If your service exposes other commands to users with arbitrary repository names, it is imperative that you defend against repository names of '--debugger' and anything starting with '--config'. The read-only mode of hg-ssh stopped working because it provided its hook configuration to "hg serve --stdio" via --config parameter. This is banned for security reasons now. This patch switches it to directly call ui.setconfig(). If your custom hosting infrastructure relies on passing --config to "hg serve --stdio", you'll need to find a different way to get that configuration into Mercurial, either by using ui.setconfig() as hg-ssh does in this patch, or by placing an hgrc file someplace where Mercurial will read it. mitrandir@fb.com provided some extra fixes for the dispatch code and for hg-ssh in places that I overlooked.

Augie Fackler - - Load All Authors

File last commit:

r31610:6dc8cacc default


                r32050:77eaf953

4.1.3 stable

Download file

             test-mac-packages.t
        
                    53 lines
            
             | 2.2 KiB
            
                | text/troff
            
             |
                Tads3Lexer
            
             / tests / test-mac-packages.t
          
                    History
                
                 |
                  Source
                 | Raw
                 |Copy content
                 |Copy permalink

        Kevin Bullock
    
osx: create a modern package including manpages...

              r29027
            
      #require test-repo slow osx osxpackaging

        timeless
    
tests: silence test-repo obsolete warning...

              r29219
            
        $ . "$TESTDIR/helpers-testrepo.sh"

        Augie Fackler
    
tests: add test for Mac OS X package construction

              r29025
            
        $ OUTPUTDIR=`pwd`

        $ export OUTPUTDIR

        $ KEEPMPKG=yes

        $ export KEEPMPKG

        $ cd "$TESTDIR"/..

        Kevin Bullock
    
osx: create a modern package including manpages...

              r29027
            
        $ rm -rf dist

        Augie Fackler
    
tests: add test for Mac OS X package construction

              r29025
            
        $ make osx > $OUTPUTDIR/build.log 2>&1

        $ cd $OUTPUTDIR

        Kevin Bullock
    
osx: create a modern package including manpages...

              r29027
            
        $ ls -d *.pkg

        Mercurial-*-macosx10.*.pkg (glob)

        $ xar -xf Mercurial*.pkg

        Augie Fackler
    
tests: add test for Mac OS X package construction

              r29025
            
      Gather list of all installed files:

        Kevin Bullock
    
osx: create a modern package including manpages...

              r29027
            
        $ lsbom mercurial.pkg/Bom > boms.txt

        Augie Fackler
    
tests: add test for Mac OS X package construction

              r29025
            
      Spot-check some randomly selected files:

        Kevin Bullock
    
osx: create a modern package including manpages...

              r29027
            
        $ grep bdiff boms.txt | cut -d '	' -f 1,2,3

        ./Library/Python/2.7/site-packages/mercurial/bdiff.so	100755	0/0

        ./Library/Python/2.7/site-packages/mercurial/pure/bdiff.py	100644	0/0

        ./Library/Python/2.7/site-packages/mercurial/pure/bdiff.pyc	100644	0/0

        ./Library/Python/2.7/site-packages/mercurial/pure/bdiff.pyo	100644	0/0

        $ egrep 'man[15]' boms.txt | cut -d '	' -f 1,2,3

        ./usr/local/share/man/man1	40755	0/0

        ./usr/local/share/man/man1/hg.1	100644	0/0

        ./usr/local/share/man/man5	40755	0/0

        ./usr/local/share/man/man5/hgignore.5	100644	0/0

        ./usr/local/share/man/man5/hgrc.5	100644	0/0

        $ grep bser boms.txt | cut -d '	' -f 1,2,3

        ./Library/Python/2.7/site-packages/hgext/fsmonitor/pywatchman/bser.so	100755	0/0

        ./Library/Python/2.7/site-packages/hgext/fsmonitor/pywatchman/pybser.py	100644	0/0

        ./Library/Python/2.7/site-packages/hgext/fsmonitor/pywatchman/pybser.pyc	100644	0/0

        ./Library/Python/2.7/site-packages/hgext/fsmonitor/pywatchman/pybser.pyo	100644	0/0

        $ grep localrepo boms.txt | cut -d '	' -f 1,2,3

        ./Library/Python/2.7/site-packages/mercurial/localrepo.py	100644	0/0

        ./Library/Python/2.7/site-packages/mercurial/localrepo.pyc	100644	0/0

        ./Library/Python/2.7/site-packages/mercurial/localrepo.pyo	100644	0/0

        $ grep '/hg	' boms.txt | cut -d '	' -f 1,2,3

        ./usr/local/bin/hg	100755	0/0

        Augie Fackler
    
tests: add test for Mac OS X package construction

              r29025
            
        Augie Fackler
    
osx: explicitly build hg with /usr/bin/python2.7...

              r29535
            
      Make sure the built binary uses the system Python interpreter

        $ bsdtar xf mercurial.pkg/Payload usr/local/bin

      Use a glob to find this to avoid check-code whining about a fixed path.

        $ head -n 1 usr/local/b?n/hg

        #!/System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python

        Augie Fackler
    
tests: add test for Mac OS X package construction

              r29025
            
      Note that we're not currently installing any /etc/mercurial stuff,

      including merge-tool configurations.

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

Kevin Bullock osx: create a modern package including manpages...	r29027	#require test-repo slow osx osxpackaging
timeless tests: silence test-repo obsolete warning...	r29219
		$ . "$TESTDIR/helpers-testrepo.sh"

Augie Fackler tests: add test for Mac OS X package construction	r29025	$ OUTPUTDIR=`pwd`
		$ export OUTPUTDIR
		$ KEEPMPKG=yes
		$ export KEEPMPKG

		$ cd "$TESTDIR"/..
Kevin Bullock osx: create a modern package including manpages...	r29027	$ rm -rf dist
Augie Fackler tests: add test for Mac OS X package construction	r29025	$ make osx > $OUTPUTDIR/build.log 2>&1
		$ cd $OUTPUTDIR
Kevin Bullock osx: create a modern package including manpages...	r29027	$ ls -d *.pkg
		Mercurial--macosx10..pkg (glob)

		$ xar -xf Mercurial*.pkg
Augie Fackler tests: add test for Mac OS X package construction	r29025
		Gather list of all installed files:
Kevin Bullock osx: create a modern package including manpages...	r29027	$ lsbom mercurial.pkg/Bom > boms.txt
Augie Fackler tests: add test for Mac OS X package construction	r29025
		Spot-check some randomly selected files:
Kevin Bullock osx: create a modern package including manpages...	r29027	$ grep bdiff boms.txt \| cut -d ' ' -f 1,2,3
		./Library/Python/2.7/site-packages/mercurial/bdiff.so 100755 0/0
		./Library/Python/2.7/site-packages/mercurial/pure/bdiff.py 100644 0/0
		./Library/Python/2.7/site-packages/mercurial/pure/bdiff.pyc 100644 0/0
		./Library/Python/2.7/site-packages/mercurial/pure/bdiff.pyo 100644 0/0
		$ egrep 'man[15]' boms.txt \| cut -d ' ' -f 1,2,3
		./usr/local/share/man/man1 40755 0/0
		./usr/local/share/man/man1/hg.1 100644 0/0
		./usr/local/share/man/man5 40755 0/0
		./usr/local/share/man/man5/hgignore.5 100644 0/0
		./usr/local/share/man/man5/hgrc.5 100644 0/0
		$ grep bser boms.txt \| cut -d ' ' -f 1,2,3
		./Library/Python/2.7/site-packages/hgext/fsmonitor/pywatchman/bser.so 100755 0/0
		./Library/Python/2.7/site-packages/hgext/fsmonitor/pywatchman/pybser.py 100644 0/0
		./Library/Python/2.7/site-packages/hgext/fsmonitor/pywatchman/pybser.pyc 100644 0/0
		./Library/Python/2.7/site-packages/hgext/fsmonitor/pywatchman/pybser.pyo 100644 0/0
		$ grep localrepo boms.txt \| cut -d ' ' -f 1,2,3
		./Library/Python/2.7/site-packages/mercurial/localrepo.py 100644 0/0
		./Library/Python/2.7/site-packages/mercurial/localrepo.pyc 100644 0/0
		./Library/Python/2.7/site-packages/mercurial/localrepo.pyo 100644 0/0
		$ grep '/hg ' boms.txt \| cut -d ' ' -f 1,2,3
		./usr/local/bin/hg 100755 0/0
Augie Fackler tests: add test for Mac OS X package construction	r29025
Augie Fackler osx: explicitly build hg with /usr/bin/python2.7...	r29535	Make sure the built binary uses the system Python interpreter
		$ bsdtar xf mercurial.pkg/Payload usr/local/bin
		Use a glob to find this to avoid check-code whining about a fixed path.
		$ head -n 1 usr/local/b?n/hg
		#!/System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python

Augie Fackler tests: add test for Mac OS X package construction	r29025	Note that we're not currently installing any /etc/mercurial stuff,
		including merge-tool configurations.