##// END OF EJS Templates
dispatch: protect against malicious 'hg serve --stdio' invocations (sec)...
dispatch: protect against malicious 'hg serve --stdio' invocations (sec) Some shared-ssh installations assume that 'hg serve --stdio' is a safe command to run for minimally trusted users. Unfortunately, the messy implementation of argument parsing here meant that trying to access a repo named '--debugger' would give the user a pdb prompt, thereby sidestepping any hoped-for sandboxing. Serving repositories over HTTP(S) is unaffected. We're not currently hardening any subcommands other than 'serve'. If your service exposes other commands to users with arbitrary repository names, it is imperative that you defend against repository names of '--debugger' and anything starting with '--config'. The read-only mode of hg-ssh stopped working because it provided its hook configuration to "hg serve --stdio" via --config parameter. This is banned for security reasons now. This patch switches it to directly call ui.setconfig(). If your custom hosting infrastructure relies on passing --config to "hg serve --stdio", you'll need to find a different way to get that configuration into Mercurial, either by using ui.setconfig() as hg-ssh does in this patch, or by placing an hgrc file someplace where Mercurial will read it. mitrandir@fb.com provided some extra fixes for the dispatch code and for hg-ssh in places that I overlooked.

File last commit:

r28957:d813132e default
r32050:77eaf953 4.1.3 stable
Show More
test-template-engine.t
54 lines | 1.5 KiB | text/troff | Tads3Lexer
/ tests / test-template-engine.t
Matt Mackall
tests: unify test-template-engine
r12493
$ cat > engine.py << EOF
>
> from mercurial import templater
>
> class mytemplater(object):
Yuya Nishihara
templater: load and expand aliases by template engine (API) (issue4842)...
r28957 > def __init__(self, loader, filters, defaults, aliases):
Matt Mackall
tests: unify test-template-engine
r12493 > self.loader = loader
>
> def process(self, t, map):
> tmpl = self.loader(t)
> for k, v in map.iteritems():
> if k in ('templ', 'ctx', 'repo', 'revcache', 'cache'):
> continue
> if hasattr(v, '__call__'):
> v = v(**map)
> v = templater.stringify(v)
> tmpl = tmpl.replace('{{%s}}' % k, v)
> yield tmpl
>
> templater.engines['my'] = mytemplater
> EOF
$ hg init test
$ echo '[extensions]' > test/.hg/hgrc
$ echo "engine = `pwd`/engine.py" >> test/.hg/hgrc
$ cd test
$ cat > mymap << EOF
> changeset = my:changeset.txt
> EOF
$ cat > changeset.txt << EOF
> {{rev}} {{node}} {{author}}
> EOF
$ hg ci -Ama
adding changeset.txt
adding mymap
$ hg log --style=./mymap
0 97e5f848f0936960273bbf75be6388cd0350a32b test
Mads Kiilerich
tests: add missing trailing 'cd ..'...
r16913
epriestley
templatekw: add parent1, parent1node, parent2, parent2node keywords...
r17355 $ cat > changeset.txt << EOF
Bryan O'Sullivan
templatekw: merge, preferring the second implementation
r17358 > {{p1rev}} {{p1node}} {{p2rev}} {{p2node}}
epriestley
templatekw: add parent1, parent1node, parent2, parent2node keywords...
r17355 > EOF
$ hg ci -Ama
$ hg log --style=./mymap
0 97e5f848f0936960273bbf75be6388cd0350a32b -1 0000000000000000000000000000000000000000
-1 0000000000000000000000000000000000000000 -1 0000000000000000000000000000000000000000
Yuya Nishihara
templater: give better error message for invalid engine type...
r28831 invalid engine type:
$ echo 'changeset = unknown:changeset.txt' > unknownenginemap
$ hg log --style=./unknownenginemap
abort: invalid template engine: unknown
[255]
Mads Kiilerich
tests: add missing trailing 'cd ..'...
r16913 $ cd ..