upstream/mercurial-mirror Files · tests/test-pull.t

dispatch: protect against malicious 'hg serve --stdio' invocations (sec)...

dispatch: protect against malicious 'hg serve --stdio' invocations (sec) Some shared-ssh installations assume that 'hg serve --stdio' is a safe command to run for minimally trusted users. Unfortunately, the messy implementation of argument parsing here meant that trying to access a repo named '--debugger' would give the user a pdb prompt, thereby sidestepping any hoped-for sandboxing. Serving repositories over HTTP(S) is unaffected. We're not currently hardening any subcommands other than 'serve'. If your service exposes other commands to users with arbitrary repository names, it is imperative that you defend against repository names of '--debugger' and anything starting with '--config'. The read-only mode of hg-ssh stopped working because it provided its hook configuration to "hg serve --stdio" via --config parameter. This is banned for security reasons now. This patch switches it to directly call ui.setconfig(). If your custom hosting infrastructure relies on passing --config to "hg serve --stdio", you'll need to find a different way to get that configuration into Mercurial, either by using ui.setconfig() as hg-ssh does in this patch, or by placing an hgrc file someplace where Mercurial will read it. mitrandir@fb.com provided some extra fixes for the dispatch code and for hg-ssh in places that I overlooked.

Matt Harbison - - Load All Authors

File last commit:

r31771:5e92ba77 default


                r32050:77eaf953

4.1.3 stable

Download file

             test-pull.t
        
                    104 lines
            
             | 2.7 KiB
            
                | text/troff
            
             |
                Tads3Lexer
            
             / tests / test-pull.t
          
                    History
                
                 |
                  Source
                 | Raw
                 |Copy content
                 |Copy permalink

        Matt Mackall
    
tests: replace exit 80 with #require

              r22046
            
      #require serve

        Mads Kiilerich
    
tests: use 'hghave serve' to guard tests that requires serve daemon management

              r15446
            
        Martin Geisler
    
tests: remove redundant mkdir...

              r13956
            
        $ hg init test

        Adrian Buehlmann
    
combine tests

              r12279
            
        $ cd test

        $ echo foo>foo

        $ hg addremove

        adding foo

        $ hg commit -m 1

        $ hg verify

        checking changesets

        checking manifests

        crosschecking files in changesets and manifests

        checking files

        1 files, 1 changesets, 1 total revisions

        $ hg serve -p $HGPORT -d --pid-file=hg.pid

        $ cat hg.pid >> $DAEMON_PIDS

        $ cd ..

        Matt Mackall
    
tests: drop a bunch of sed calls from unified tests

              r12366
            
        $ hg clone --pull http://foo:bar@localhost:$HGPORT/ copy

        Adrian Buehlmann
    
combine tests

              r12279
            
        requesting all changes

        adding changesets

        adding manifests

        adding file changes

        added 1 changesets with 1 changes to 1 files

        updating to branch default

        1 files updated, 0 files merged, 0 files removed, 0 files unresolved

        $ cd copy

        $ hg verify

        checking changesets

        checking manifests

        crosschecking files in changesets and manifests

        checking files

        1 files, 1 changesets, 1 total revisions

        $ hg co

        0 files updated, 0 files merged, 0 files removed, 0 files unresolved

        $ cat foo

        foo

        $ hg manifest --debug

        2ed2a3912a0b24502043eae84ee4b279c18b90dd 644   foo

        Matt Mackall
    
tests: drop a bunch of sed calls from unified tests

              r12366
            
        $ hg pull

        Augie Fackler
    
clone: don't save user's password in .hg/hgrc (Issue3122)

              r15552
            
        pulling from http://foo@localhost:$HGPORT/

        Adrian Buehlmann
    
combine tests

              r12279
            
        searching for changes

        no changes found

        Matt Mackall
    
tests: drop a bunch of sed calls from unified tests

              r12366
            
        $ hg rollback --dry-run --verbose

        Gilles Moris
    
rollback: clarifies the message about the reverted state (issue2628)...

              r13446
            
        repository tip rolled back to revision -1 (undo pull: http://foo:***@localhost:$HGPORT/)

        Adrian Buehlmann
    
combine tests

              r12279
            
        Mads Kiilerich
    
context: don't hex encode all unknown 20 char revision specs (issue4890)...

              r26604
            
      Test pull of non-existing 20 character revision specification, making sure plain ascii identifiers

      not are encoded like a node:

        $ hg pull -r 'xxxxxxxxxxxxxxxxxxxy'

        pulling from http://foo@localhost:$HGPORT/

        abort: unknown revision 'xxxxxxxxxxxxxxxxxxxy'!

        [255]

        $ hg pull -r 'xxxxxxxxxxxxxxxxxx y'

        pulling from http://foo@localhost:$HGPORT/

        abort: unknown revision '7878787878787878787878787878787878782079'!

        [255]

        Martin Geisler
    
tests: added a short description to issue numbers...

              r12399
            
      Issue622: hg init && hg pull -u URL doesn't checkout default branch

        Adrian Buehlmann
    
combine tests

              r12279
            
        $ cd ..

        $ hg init empty

        $ cd empty

        $ hg pull -u ../test

        pulling from ../test

        requesting all changes

        adding changesets

        adding manifests

        adding file changes

        added 1 changesets with 1 changes to 1 files

        1 files updated, 0 files merged, 0 files removed, 0 files unresolved

      Test 'file:' uri handling:

        timeless@mozdev.org
    
spelling: doesn't/does not

              r17486
            
        $ hg pull -q file://../test-does-not-exist

        Brodie Rao
    
hg: look up schemes using url.url

              r13823
            
        abort: file:// URLs can only refer to localhost

        Matt Mackall
    
tests: add exit codes to unified tests

              r12316
            
        [255]

        Adrian Buehlmann
    
combine tests

              r12279
            
        Brodie Rao
    
url: refactor util.drop_scheme() and hg.localpath() into url.localpath()...

              r13826
            
        $ hg pull -q file://../test

        abort: file:// URLs can only refer to localhost

        [255]

        Matt Mackall
    
check-code: allow disabling msys path check

              r24205
            
        $ hg pull -q file:../test  # no-msys

        Adrian Buehlmann
    
combine tests

              r12279
            
        Matt Mackall
    
tests: fix a bunch of pointless #s in unified tests

              r12328
            
      It's tricky to make file:// URLs working on every platform with

      regular shell commands.

        Adrian Buehlmann
    
combine tests

              r12279
            
        Augie Fackler
    
tests: use $PYTHON instead of hardcoding python...

              r22947
            
        $ URL=`$PYTHON -c "import os; print 'file://foobar' + ('/' + os.getcwd().replace(os.sep, '/')).replace('//', '/') + '/../test'"`

        Adrian Buehlmann
    
combine tests

              r12279
            
        $ hg pull -q "$URL"

        Brodie Rao
    
url: abort on file:// URLs with non-localhost hosts

              r13817
            
        abort: file:// URLs can only refer to localhost

        [255]

        Adrian Buehlmann
    
combine tests

              r12279
            
        Augie Fackler
    
tests: use $PYTHON instead of hardcoding python...

              r22947
            
        $ URL=`$PYTHON -c "import os; print 'file://localhost' + ('/' + os.getcwd().replace(os.sep, '/')).replace('//', '/') + '/../test'"`

        Brodie Rao
    
url: abort on file:// URLs with non-localhost hosts

              r13817
            
        $ hg pull -q "$URL"

        Mads Kiilerich
    
tests: add missing trailing 'cd ..'...

              r16913
            
        $ cd ..

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

Matt Mackall tests: replace exit 80 with #require	r22046	#require serve
Mads Kiilerich tests: use 'hghave serve' to guard tests that requires serve daemon management	r15446
Martin Geisler tests: remove redundant mkdir...	r13956	$ hg init test
Adrian Buehlmann combine tests	r12279	$ cd test

		$ echo foo>foo
		$ hg addremove
		adding foo
		$ hg commit -m 1

		$ hg verify
		checking changesets
		checking manifests
		crosschecking files in changesets and manifests
		checking files
		1 files, 1 changesets, 1 total revisions

		$ hg serve -p $HGPORT -d --pid-file=hg.pid
		$ cat hg.pid >> $DAEMON_PIDS
		$ cd ..

Matt Mackall tests: drop a bunch of sed calls from unified tests	r12366	$ hg clone --pull http://foo:bar@localhost:$HGPORT/ copy
Adrian Buehlmann combine tests	r12279	requesting all changes
		adding changesets
		adding manifests
		adding file changes
		added 1 changesets with 1 changes to 1 files
		updating to branch default
		1 files updated, 0 files merged, 0 files removed, 0 files unresolved

		$ cd copy
		$ hg verify
		checking changesets
		checking manifests
		crosschecking files in changesets and manifests
		checking files
		1 files, 1 changesets, 1 total revisions

		$ hg co
		0 files updated, 0 files merged, 0 files removed, 0 files unresolved
		$ cat foo
		foo

		$ hg manifest --debug
		2ed2a3912a0b24502043eae84ee4b279c18b90dd 644 foo

Matt Mackall tests: drop a bunch of sed calls from unified tests	r12366	$ hg pull
Augie Fackler clone: don't save user's password in .hg/hgrc (Issue3122)	r15552	pulling from http://foo@localhost:$HGPORT/
Adrian Buehlmann combine tests	r12279	searching for changes
		no changes found

Matt Mackall tests: drop a bunch of sed calls from unified tests	r12366	$ hg rollback --dry-run --verbose
Gilles Moris rollback: clarifies the message about the reverted state (issue2628)...	r13446	repository tip rolled back to revision -1 (undo pull: http://foo:***@localhost:$HGPORT/)
Adrian Buehlmann combine tests	r12279
Mads Kiilerich context: don't hex encode all unknown 20 char revision specs (issue4890)...	r26604	Test pull of non-existing 20 character revision specification, making sure plain ascii identifiers
		not are encoded like a node:

		$ hg pull -r 'xxxxxxxxxxxxxxxxxxxy'
		pulling from http://foo@localhost:$HGPORT/
		abort: unknown revision 'xxxxxxxxxxxxxxxxxxxy'!
		[255]
		$ hg pull -r 'xxxxxxxxxxxxxxxxxx y'
		pulling from http://foo@localhost:$HGPORT/
		abort: unknown revision '7878787878787878787878787878787878782079'!
		[255]

Martin Geisler tests: added a short description to issue numbers...	r12399	Issue622: hg init && hg pull -u URL doesn't checkout default branch
Adrian Buehlmann combine tests	r12279
		$ cd ..
		$ hg init empty
		$ cd empty
		$ hg pull -u ../test
		pulling from ../test
		requesting all changes
		adding changesets
		adding manifests
		adding file changes
		added 1 changesets with 1 changes to 1 files
		1 files updated, 0 files merged, 0 files removed, 0 files unresolved

		Test 'file:' uri handling:

timeless@mozdev.org spelling: doesn't/does not	r17486	$ hg pull -q file://../test-does-not-exist
Brodie Rao hg: look up schemes using url.url	r13823	abort: file:// URLs can only refer to localhost
Matt Mackall tests: add exit codes to unified tests	r12316	[255]
Adrian Buehlmann combine tests	r12279
Brodie Rao url: refactor util.drop_scheme() and hg.localpath() into url.localpath()...	r13826	$ hg pull -q file://../test
		abort: file:// URLs can only refer to localhost
		[255]

Matt Mackall check-code: allow disabling msys path check	r24205	$ hg pull -q file:../test # no-msys
Adrian Buehlmann combine tests	r12279
Matt Mackall tests: fix a bunch of pointless #s in unified tests	r12328	It's tricky to make file:// URLs working on every platform with
		regular shell commands.
Adrian Buehlmann combine tests	r12279
Augie Fackler tests: use $PYTHON instead of hardcoding python...	r22947	$ URL=`$PYTHON -c "import os; print 'file://foobar' + ('/' + os.getcwd().replace(os.sep, '/')).replace('//', '/') + '/../test'"`
Adrian Buehlmann combine tests	r12279	$ hg pull -q "$URL"
Brodie Rao url: abort on file:// URLs with non-localhost hosts	r13817	abort: file:// URLs can only refer to localhost
		[255]
Adrian Buehlmann combine tests	r12279
Augie Fackler tests: use $PYTHON instead of hardcoding python...	r22947	$ URL=`$PYTHON -c "import os; print 'file://localhost' + ('/' + os.getcwd().replace(os.sep, '/')).replace('//', '/') + '/../test'"`
Brodie Rao url: abort on file:// URLs with non-localhost hosts	r13817	$ hg pull -q "$URL"
Mads Kiilerich tests: add missing trailing 'cd ..'...	r16913
		$ cd ..