##// END OF EJS Templates
convert: test for shell injection in git calls (SEC)...
convert: test for shell injection in git calls (SEC) CVE-2016-3069 (5/5) Before recent refactoring we were not escaping calls to git at all which made such injections possible. Let's have a test for that to avoid this problem in the future. Reported by Blake Burkhart.

File last commit:

r15194:0705f2ac default
r28663:ae279d4a 3.7.3 stable
Show More
test-patch.t
89 lines | 2.3 KiB | text/troff | Tads3Lexer
Nicolas Dumazet
tests: unify test-patch
r11784 $ cat > patchtool.py <<EOF
> import sys
> print 'Using custom patch'
> if '--binary' in sys.argv:
> print '--binary found !'
> EOF
$ echo "[ui]" >> $HGRCPATH
$ echo "patch=python ../patchtool.py" >> $HGRCPATH
$ hg init a
$ cd a
$ echo a > a
$ hg commit -Ama -d '1 0'
adding a
$ echo b >> a
$ hg commit -Amb -d '2 0'
$ cd ..
Christian Ebert
test-patch.t: typos
r11815 This test checks that:
- custom patch commands with arguments actually work
Nicolas Dumazet
tests: unify test-patch
r11784 - patch code does not try to add weird arguments like
--binary when custom patch commands are used. For instance
--binary is added by default under win32.
check custom patch options are honored
$ hg --cwd a export -o ../a.diff tip
$ hg clone -r 0 a b
adding changesets
adding manifests
adding file changes
added 1 changesets with 1 changes to 1 files
updating to branch default
1 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ hg --cwd b import -v ../a.diff
applying ../a.diff
Using custom patch
Greg Ward
import: simplify status reporting logic (and make it more I18N-friendly)...
r15194 applied to working directory
Mads Kiilerich
import: don't strip '#' lines from patch descriptions (issue 2417)...
r12645
Issue2417: hg import with # comments in description
Prepare source repo and patch:
$ rm $HGRCPATH
$ hg init c
$ cd c
Wagner Bruna
patch: fix parsing patch files containing CRs not followed by LFs...
r14832 $ printf "a\rc" > a
Mads Kiilerich
import: don't strip '#' lines from patch descriptions (issue 2417)...
r12645 $ hg ci -A -m 0 a -d '0 0'
Wagner Bruna
patch: fix parsing patch files containing CRs not followed by LFs...
r14832 $ printf "a\rb\rc" > a
Mads Kiilerich
import: don't strip '#' lines from patch descriptions (issue 2417)...
r12645 $ cat << eof > log
Mads Kiilerich
import: only the first hg patch marker should be processed (issue2417)...
r12728 > first line which can't start with '# '
> # second line is a comment but that shouldn't be a problem.
> A patch marker like this was more problematic even after d7452292f9d3:
> # HG changeset patch
> # User lines looks like this - but it _is_ just a comment
Mads Kiilerich
import: don't strip '#' lines from patch descriptions (issue 2417)...
r12645 > eof
$ hg ci -l log -d '0 0'
$ hg export -o p 1
$ cd ..
Clone and apply patch:
$ hg clone -r 0 c d
adding changesets
adding manifests
adding file changes
added 1 changesets with 1 changes to 1 files
updating to branch default
1 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ cd d
$ hg import ../c/p
applying ../c/p
$ hg log -v -r 1
Wagner Bruna
patch: fix parsing patch files containing CRs not followed by LFs...
r14832 changeset: 1:cd0bde79c428
Mads Kiilerich
import: don't strip '#' lines from patch descriptions (issue 2417)...
r12645 tag: tip
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: a
description:
Mads Kiilerich
import: only the first hg patch marker should be processed (issue2417)...
r12728 first line which can't start with '# '
# second line is a comment but that shouldn't be a problem.
A patch marker like this was more problematic even after d7452292f9d3:
# HG changeset patch
# User lines looks like this - but it _is_ just a comment
Mads Kiilerich
import: don't strip '#' lines from patch descriptions (issue 2417)...
r12645
$ cd ..