##// END OF EJS Templates
convert: test for shell injection in git calls (SEC)...
convert: test for shell injection in git calls (SEC) CVE-2016-3069 (5/5) Before recent refactoring we were not escaping calls to git at all which made such injections possible. Let's have a test for that to avoid this problem in the future. Reported by Blake Burkhart.

File last commit:

r25474:8c14f87b default
r28663:ae279d4a 3.7.3 stable
Show More
test-mq-qclone-http.t
156 lines | 3.8 KiB | text/troff | Tads3Lexer
/ tests / test-mq-qclone-http.t
Matt Mackall
tests: replace exit 80 with #require
r22046 #require killdaemons
Matt Mackall
tests: unify test-mq-qclone-http
r12463
Mads Kiilerich
tests: add missing no-outer-repo requirements...
r17015 hide outer repo
$ hg init
Matt Mackall
tests: unify test-mq-qclone-http
r12463 $ echo "[extensions]" >> $HGRCPATH
$ echo "mq=" >> $HGRCPATH
$ mkdir webdir
$ cd webdir
$ hg init a
$ hg --cwd a qinit -c
$ echo a > a/a
$ hg --cwd a ci -A -m a
adding a
$ echo b > a/b
$ hg --cwd a addremove
adding b
$ hg --cwd a qnew -f b.patch
$ hg --cwd a qcommit -m b.patch
$ hg --cwd a log --template "{desc}\n"
[mq]: b.patch
a
$ hg --cwd a/.hg/patches log --template "{desc}\n"
b.patch
$ root=`pwd`
$ cd ..
test with recursive collection
$ cat > collections.conf <<EOF
> [paths]
> /=$root/**
> EOF
$ hg serve -p $HGPORT -d --pid-file=hg.pid --webdir-conf collections.conf \
> -A access-paths.log -E error-paths-1.log
$ cat hg.pid >> $DAEMON_PIDS
Matt Mackall
tests: drop explicit $TESTDIR from executables...
r25472 $ get-with-headers.py localhost:$HGPORT '?style=raw'
Matt Mackall
tests: unify test-mq-qclone-http
r12463 200 Script output follows
/a/
/a/.hg/patches/
$ hg qclone http://localhost:$HGPORT/a b
requesting all changes
adding changesets
adding manifests
adding file changes
Matt Mackall
mq: add secret setting
r16017 added 2 changesets with 2 changes to 2 files
Matt Mackall
tests: unify test-mq-qclone-http
r12463 requesting all changes
adding changesets
adding manifests
adding file changes
added 1 changesets with 3 changes to 3 files
updating to branch default
3 files updated, 0 files merged, 0 files removed, 0 files unresolved
1 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ hg --cwd b log --template "{desc}\n"
a
$ hg --cwd b qpush -a
applying b.patch
now at: b.patch
$ hg --cwd b log --template "{desc}\n"
imported patch b.patch
a
test with normal collection
$ cat > collections1.conf <<EOF
> [paths]
> /=$root/*
> EOF
$ hg serve -p $HGPORT1 -d --pid-file=hg.pid --webdir-conf collections1.conf \
> -A access-paths.log -E error-paths-1.log
$ cat hg.pid >> $DAEMON_PIDS
Matt Mackall
tests: drop explicit $TESTDIR from executables...
r25472 $ get-with-headers.py localhost:$HGPORT1 '?style=raw'
Matt Mackall
tests: unify test-mq-qclone-http
r12463 200 Script output follows
/a/
/a/.hg/patches/
$ hg qclone http://localhost:$HGPORT1/a c
requesting all changes
adding changesets
adding manifests
adding file changes
Matt Mackall
mq: add secret setting
r16017 added 2 changesets with 2 changes to 2 files
Matt Mackall
tests: unify test-mq-qclone-http
r12463 requesting all changes
adding changesets
adding manifests
adding file changes
added 1 changesets with 3 changes to 3 files
updating to branch default
3 files updated, 0 files merged, 0 files removed, 0 files unresolved
1 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ hg --cwd c log --template "{desc}\n"
a
$ hg --cwd c qpush -a
applying b.patch
now at: b.patch
$ hg --cwd c log --template "{desc}\n"
imported patch b.patch
a
test with old-style collection
$ cat > collections2.conf <<EOF
> [collections]
> $root=$root
> EOF
$ hg serve -p $HGPORT2 -d --pid-file=hg.pid --webdir-conf collections2.conf \
> -A access-paths.log -E error-paths-1.log
$ cat hg.pid >> $DAEMON_PIDS
Matt Mackall
tests: drop explicit $TESTDIR from executables...
r25472 $ get-with-headers.py localhost:$HGPORT2 '?style=raw'
Matt Mackall
tests: unify test-mq-qclone-http
r12463 200 Script output follows
/a/
/a/.hg/patches/
$ hg qclone http://localhost:$HGPORT2/a d
requesting all changes
adding changesets
adding manifests
adding file changes
Matt Mackall
mq: add secret setting
r16017 added 2 changesets with 2 changes to 2 files
Matt Mackall
tests: unify test-mq-qclone-http
r12463 requesting all changes
adding changesets
adding manifests
adding file changes
added 1 changesets with 3 changes to 3 files
updating to branch default
3 files updated, 0 files merged, 0 files removed, 0 files unresolved
1 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ hg --cwd d log --template "{desc}\n"
a
$ hg --cwd d qpush -a
applying b.patch
now at: b.patch
$ hg --cwd d log --template "{desc}\n"
imported patch b.patch
a
test --mq works and uses correct repository config
$ hg --cwd d outgoing --mq
Mads Kiilerich
tests: reintroduce ":$HGPORT" in test output...
r12643 comparing with http://localhost:$HGPORT2/a/.hg/patches
Matt Mackall
tests: unify test-mq-qclone-http
r12463 searching for changes
no changes found
[1]
$ hg --cwd d log --mq --template '{rev} {desc|firstline}\n'
0 b.patch
Patrick Mezard
tests: enable even more Windows server tests
r17565
Matt Mackall
tests: drop DAEMON_PIDS from killdaemons calls
r25474 $ killdaemons.py
Patrick Mezard
tests: enable even more Windows server tests
r17565