narrowspec: limit patterns to path: and rootfilesin: (BC)

Some matcher patterns are computationally expensive and may even
have security issues (e.g. evaluating some file sets). For these
reasons, we want to limit the types of matcher patterns that can
be used in narrow specs and by command line arguments used for
defining narrow specs.

This commit teaches ``narrowspec.parsepatterns()`` to validate the
pattern types against "safe" patterns.

Surprisingly, no existing tests broke. So tests for the feature
have been added.

We also added a function to validate a patterns data structure.
This will be used in future commits.

Differential Revision: https://phab.mercurial-scm.org/D4522

mercurial/narrowspec.py

@@ -1,198 +1,241 b''
 # narrowspec.py - methods for working with a narrow view of a repository
 #
 # Copyright 2017 Google, Inc.
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 from __future__ import absolute_import
 
 import errno
 
 from .i18n import _
 from . import (
     error,
     match as matchmod,
     repository,
     sparse,
     util,
 )
 
 FILENAME = 'narrowspec'
 
+# Pattern prefixes that are allowed in narrow patterns. This list MUST
+# only contain patterns that are fast and safe to evaluate. Keep in mind
+# that patterns are supplied by clients and executed on remote servers
+# as part of wire protocol commands.
+VALID_PREFIXES = (
+    b'path:',
+    b'rootfilesin:',
+)
+
 def parseserverpatterns(text):
     """Parses the narrowspec format that's returned by the server."""
     includepats = set()
     excludepats = set()
 
     # We get one entry per line, in the format "<key> <value>".
     # It's OK for value to contain other spaces.
     for kp in (l.split(' ', 1) for l in text.splitlines()):
         if len(kp) != 2:
             raise error.Abort(_('Invalid narrowspec pattern line: "%s"') % kp)
         key = kp[0]
         pat = kp[1]
         if key == 'include':
             includepats.add(pat)
         elif key == 'exclude':
             excludepats.add(pat)
         else:
             raise error.Abort(_('Invalid key "%s" in server response') % key)
 
     return includepats, excludepats
 
 def normalizesplitpattern(kind, pat):
     """Returns the normalized version of a pattern and kind.
 
     Returns a tuple with the normalized kind and normalized pattern.
     """
     pat = pat.rstrip('/')
     _validatepattern(pat)
     return kind, pat
 
 def _numlines(s):
     """Returns the number of lines in s, including ending empty lines."""
     # We use splitlines because it is Unicode-friendly and thus Python 3
     # compatible. However, it does not count empty lines at the end, so trick
     # it by adding a character at the end.
     return len((s + 'x').splitlines())
 
 def _validatepattern(pat):
     """Validates the pattern and aborts if it is invalid.
 
     Patterns are stored in the narrowspec as newline-separated
     POSIX-style bytestring paths. There's no escaping.
     """
 
     # We use newlines as separators in the narrowspec file, so don't allow them
     # in patterns.
     if _numlines(pat) > 1:
         raise error.Abort(_('newlines are not allowed in narrowspec paths'))
 
     components = pat.split('/')
     if '.' in components or '..' in components:
         raise error.Abort(_('"." and ".." are not allowed in narrowspec paths'))
 
 def normalizepattern(pattern, defaultkind='path'):
     """Returns the normalized version of a text-format pattern.
 
     If the pattern has no kind, the default will be added.
     """
     kind, pat = matchmod._patsplit(pattern, defaultkind)
     return '%s:%s' % normalizesplitpattern(kind, pat)
 
 def parsepatterns(pats):
-    """Parses a list of patterns into a typed pattern set."""
-    return set(normalizepattern(p) for p in pats)
+    """Parses an iterable of patterns into a typed pattern set.
+
+    Patterns are assumed to be ``path:`` if no prefix is present.
+    For safety and performance reasons, only some prefixes are allowed.
+    See ``validatepatterns()``.
+
+    This function should be used on patterns that come from the user to
+    normalize and validate them to the internal data structure used for
+    representing patterns.
+    """
+    res = {normalizepattern(orig) for orig in pats}
+    validatepatterns(res)
+    return res
+
+def validatepatterns(pats):
+    """Validate that patterns are in the expected data structure and format.
+
+    And that is a set of normalized patterns beginning with ``path:`` or
+    ``rootfilesin:``.
+
+    This function should be used to validate internal data structures
+    and patterns that are loaded from sources that use the internal,
+    prefixed pattern representation (but can't necessarily be fully trusted).
+    """
+    if not isinstance(pats, set):
+        raise error.ProgrammingError('narrow patterns should be a set; '
+                                     'got %r' % pats)
+
+    for pat in pats:
+        if not pat.startswith(VALID_PREFIXES):
+            # Use a Mercurial exception because this can happen due to user
+            # bugs (e.g. manually updating spec file).
+            raise error.Abort(_('invalid prefix on narrow pattern: %s') % pat,
+                              hint=_('narrow patterns must begin with one of '
+                                     'the following: %s') %
+                                   ', '.join(VALID_PREFIXES))
 
 def format(includes, excludes):
     output = '[include]\n'
     for i in sorted(includes - excludes):
         output += i + '\n'
     output += '[exclude]\n'
     for e in sorted(excludes):
         output += e + '\n'
     return output
 
 def match(root, include=None, exclude=None):
     if not include:
         # Passing empty include and empty exclude to matchmod.match()
         # gives a matcher that matches everything, so explicitly use
         # the nevermatcher.
         return matchmod.never(root, '')
     return matchmod.match(root, '', [], include=include or [],
                           exclude=exclude or [])
 
 def needsexpansion(includes):
     return [i for i in includes if i.startswith('include:')]
 
 def load(repo):
     try:
         spec = repo.svfs.read(FILENAME)
     except IOError as e:
         # Treat "narrowspec does not exist" the same as "narrowspec file exists
         # and is empty".
         if e.errno == errno.ENOENT:
             return set(), set()
         raise
     # maybe we should care about the profiles returned too
     includepats, excludepats, profiles = sparse.parseconfig(repo.ui, spec,
                                                             'narrow')
     if profiles:
         raise error.Abort(_("including other spec files using '%include' is not"
                             " supported in narrowspec"))
     return includepats, excludepats
 
 def save(repo, includepats, excludepats):
     spec = format(includepats, excludepats)
     repo.svfs.write(FILENAME, spec)
 
 def savebackup(repo, backupname):
     if repository.NARROW_REQUIREMENT not in repo.requirements:
         return
     vfs = repo.vfs
     vfs.tryunlink(backupname)
     util.copyfile(repo.svfs.join(FILENAME), vfs.join(backupname), hardlink=True)
 
 def restorebackup(repo, backupname):
     if repository.NARROW_REQUIREMENT not in repo.requirements:
         return
     util.rename(repo.vfs.join(backupname), repo.svfs.join(FILENAME))
 
 def clearbackup(repo, backupname):
     if repository.NARROW_REQUIREMENT not in repo.requirements:
         return
     repo.vfs.unlink(backupname)
 
 def restrictpatterns(req_includes, req_excludes, repo_includes, repo_excludes):
     r""" Restricts the patterns according to repo settings,
     results in a logical AND operation
 
     :param req_includes: requested includes
     :param req_excludes: requested excludes
     :param repo_includes: repo includes
     :param repo_excludes: repo excludes
     :return: include patterns, exclude patterns, and invalid include patterns.
 
     >>> restrictpatterns({'f1','f2'}, {}, ['f1'], [])
     (set(['f1']), {}, [])
     >>> restrictpatterns({'f1'}, {}, ['f1','f2'], [])
     (set(['f1']), {}, [])
     >>> restrictpatterns({'f1/fc1', 'f3/fc3'}, {}, ['f1','f2'], [])
     (set(['f1/fc1']), {}, [])
     >>> restrictpatterns({'f1_fc1'}, {}, ['f1','f2'], [])
     ([], set(['path:.']), [])
     >>> restrictpatterns({'f1/../f2/fc2'}, {}, ['f1','f2'], [])
     (set(['f2/fc2']), {}, [])
     >>> restrictpatterns({'f1/../f3/fc3'}, {}, ['f1','f2'], [])
     ([], set(['path:.']), [])
     >>> restrictpatterns({'f1/$non_exitent_var'}, {}, ['f1','f2'], [])
     (set(['f1/$non_exitent_var']), {}, [])
     """
     res_excludes = set(req_excludes)
     res_excludes.update(repo_excludes)
     invalid_includes = []
     if not req_includes:
         res_includes = set(repo_includes)
     elif 'path:.' not in repo_includes:
         res_includes = []
         for req_include in req_includes:
             req_include = util.expandpath(util.normpath(req_include))
             if req_include in repo_includes:
                 res_includes.append(req_include)
                 continue
             valid = False
             for repo_include in repo_includes:
                 if req_include.startswith(repo_include + '/'):
                     valid = True
                     res_includes.append(req_include)
                     break
             if not valid:
                 invalid_includes.append(req_include)
         if len(res_includes) == 0:
             res_excludes = {'path:.'}
         else:
             res_includes = set(res_includes)
     else:
         res_includes = set(req_includes)
     return res_includes, res_excludes, invalid_includes

tests/test-narrow-clone.t

@@ -1,256 +1,284 b''
   $ . "$TESTDIR/narrow-library.sh"
 
   $ hg init master
   $ cd master
   $ cat >> .hg/hgrc <<EOF
   > [narrow]
   > serveellipses=True
   > EOF
   $ mkdir dir
   $ mkdir dir/src
   $ cd dir/src
   $ for x in `$TESTDIR/seq.py 20`; do echo $x > "f$x"; hg add "f$x"; hg commit -m "Commit src $x"; done
   $ cd ..
   $ mkdir tests
   $ cd tests
   $ for x in `$TESTDIR/seq.py 20`; do echo $x > "t$x"; hg add "t$x"; hg commit -m "Commit test $x"; done
   $ cd ../../..
 
+Only path: and rootfilesin: pattern prefixes are allowed
+
+  $ hg clone --narrow ssh://user@dummy/master badnarrow --noupdate --include 'glob:**'
+  requesting all changes
+  abort: invalid prefix on narrow pattern: glob:**
+  (narrow patterns must begin with one of the following: path:, rootfilesin:)
+  [255]
+
+  $ hg clone --narrow ssh://user@dummy/master badnarrow --noupdate --exclude 'set:ignored'
+  requesting all changes
+  abort: invalid prefix on narrow pattern: set:ignored
+  (narrow patterns must begin with one of the following: path:, rootfilesin:)
+  [255]
+
 narrow clone a file, f10
 
   $ hg clone --narrow ssh://user@dummy/master narrow --noupdate --include "dir/src/f10"
   requesting all changes
   adding changesets
   adding manifests
   adding file changes
   added 3 changesets with 1 changes to 1 files
   new changesets *:* (glob)
   $ cd narrow
   $ cat .hg/requires | grep -v generaldelta
   dotencode
   fncache
   narrowhg-experimental
   revlogv1
   store
   testonly-simplestore (reposimplestore !)
 
   $ hg tracked
   I path:dir/src/f10
   $ hg tracked
   I path:dir/src/f10
   $ hg update
   1 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ find * | sort
   dir
   dir/src
   dir/src/f10
   $ cat dir/src/f10
   10
 
   $ cd ..
 
 narrow clone with a newline should fail
 
   $ hg clone --narrow ssh://user@dummy/master narrow_fail --noupdate --include 'dir/src/f10
   > '
   requesting all changes
   abort: newlines are not allowed in narrowspec paths
   [255]
 
 narrow clone a directory, tests/, except tests/t19
 
   $ hg clone --narrow ssh://user@dummy/master narrowdir --noupdate --include "dir/tests/" --exclude "dir/tests/t19"
   requesting all changes
   adding changesets
   adding manifests
   adding file changes
   added 21 changesets with 19 changes to 19 files
   new changesets *:* (glob)
   $ cd narrowdir
   $ hg tracked
   I path:dir/tests
   X path:dir/tests/t19
   $ hg tracked
   I path:dir/tests
   X path:dir/tests/t19
   $ hg update
   19 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ find * | sort
   dir
   dir/tests
   dir/tests/t1
   dir/tests/t10
   dir/tests/t11
   dir/tests/t12
   dir/tests/t13
   dir/tests/t14
   dir/tests/t15
   dir/tests/t16
   dir/tests/t17
   dir/tests/t18
   dir/tests/t2
   dir/tests/t20
   dir/tests/t3
   dir/tests/t4
   dir/tests/t5
   dir/tests/t6
   dir/tests/t7
   dir/tests/t8
   dir/tests/t9
 
   $ cd ..
 
 narrow clone everything but a directory (tests/)
 
   $ hg clone --narrow ssh://user@dummy/master narrowroot --noupdate --exclude "dir/tests"
   requesting all changes
   adding changesets
   adding manifests
   adding file changes
   added 21 changesets with 20 changes to 20 files
   new changesets *:* (glob)
   $ cd narrowroot
   $ hg tracked
   I path:.
   X path:dir/tests
   $ hg tracked
   I path:.
   X path:dir/tests
   $ hg update
   20 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ find * | sort
   dir
   dir/src
   dir/src/f1
   dir/src/f10
   dir/src/f11
   dir/src/f12
   dir/src/f13
   dir/src/f14
   dir/src/f15
   dir/src/f16
   dir/src/f17
   dir/src/f18
   dir/src/f19
   dir/src/f2
   dir/src/f20
   dir/src/f3
   dir/src/f4
   dir/src/f5
   dir/src/f6
   dir/src/f7
   dir/src/f8
   dir/src/f9
 
   $ cd ..
 
 narrow clone no paths at all
 
   $ hg clone --narrow ssh://user@dummy/master narrowempty --noupdate
   requesting all changes
   adding changesets
   adding manifests
   adding file changes
   added 1 changesets with 0 changes to 0 files
   new changesets * (glob)
   $ cd narrowempty
   $ hg tracked
   $ hg update
   0 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ ls
 
   $ cd ..
 
 simple clone
   $ hg clone ssh://user@dummy/master simpleclone
   requesting all changes
   adding changesets
   adding manifests
   adding file changes
   added 40 changesets with 40 changes to 40 files
   new changesets * (glob)
   updating to branch default
   40 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ cd simpleclone
   $ find * | sort
   dir
   dir/src
   dir/src/f1
   dir/src/f10
   dir/src/f11
   dir/src/f12
   dir/src/f13
   dir/src/f14
   dir/src/f15
   dir/src/f16
   dir/src/f17
   dir/src/f18
   dir/src/f19
   dir/src/f2
   dir/src/f20
   dir/src/f3
   dir/src/f4
   dir/src/f5
   dir/src/f6
   dir/src/f7
   dir/src/f8
   dir/src/f9
   dir/tests
   dir/tests/t1
   dir/tests/t10
   dir/tests/t11
   dir/tests/t12
   dir/tests/t13
   dir/tests/t14
   dir/tests/t15
   dir/tests/t16
   dir/tests/t17
   dir/tests/t18
   dir/tests/t19
   dir/tests/t2
   dir/tests/t20
   dir/tests/t3
   dir/tests/t4
   dir/tests/t5
   dir/tests/t6
   dir/tests/t7
   dir/tests/t8
   dir/tests/t9
 
   $ cd ..
 
 Testing the --narrowspec flag to clone
 
   $ cat >> narrowspecs <<EOF
   > %include foo
   > [include]
   > path:dir/tests/
   > dir/src/f12
   > EOF
 
   $ hg clone ssh://user@dummy/master specfile --narrowspec narrowspecs
   reading narrowspec from '$TESTTMP/narrowspecs'
   abort: cannot specify other files using '%include' in narrowspec
   [255]
 
   $ cat > narrowspecs <<EOF
   > [include]
   > path:dir/tests/
   > file:dir/src/f12
   > EOF
 
   $ hg clone ssh://user@dummy/master specfile --narrowspec narrowspecs
   reading narrowspec from '$TESTTMP/narrowspecs'
   requesting all changes
   adding changesets
   adding manifests
   adding file changes
   added 21 changesets with 20 changes to 20 files
   new changesets f93383bb3e99:26ce255d5b5d
   updating to branch default
   20 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ cd specfile
   $ hg tracked
   I path:dir/tests
   I path:file:dir/src/f12
   $ cd ..
+
+Narrow spec with invalid patterns is rejected
+
+  $ cat > narrowspecs <<EOF
+  > [include]
+  > glob:**
+  > EOF
+
+  $ hg clone ssh://user@dummy/master badspecfile --narrowspec narrowspecs
+  reading narrowspec from '$TESTTMP/narrowspecs'
+  requesting all changes
+  abort: invalid prefix on narrow pattern: glob:**
+  (narrow patterns must begin with one of the following: path:, rootfilesin:)
+  [255]

tests/test-narrow-patterns.t

@@ -1,429 +1,441 b''
   $ . "$TESTDIR/narrow-library.sh"
 
 initialize nested directories to validate complex include/exclude patterns
 
   $ hg init master
   $ cd master
   $ cat >> .hg/hgrc <<EOF
   > [narrow]
   > serveellipses=True
   > EOF
 
   $ echo root > root
   $ hg add root
   $ hg commit -m 'add root'
 
   $ for d in dir1 dir2 dir1/dirA dir1/dirB dir2/dirA dir2/dirB
   > do
   >   mkdir -p $d
   >   echo $d/foo > $d/foo
   >   hg add $d/foo
   >   hg commit -m "add $d/foo"
   >   echo $d/bar > $d/bar
   >   hg add $d/bar
   >   hg commit -m "add $d/bar"
   > done
 #if execbit
   $ chmod +x dir1/dirA/foo
   $ hg commit -m "make dir1/dirA/foo executable"
 #else
   $ hg import --bypass - <<EOF
   > # HG changeset patch
   > make dir1/dirA/foo executable
   > 
   > diff --git a/dir1/dirA/foo b/dir1/dirA/foo
   > old mode 100644
   > new mode 100755
   > EOF
   applying patch from stdin
   $ hg update -qr tip
 #endif
   $ hg log -G -T '{rev} {node|short} {files}\n'
   @  13 c87ca422d521 dir1/dirA/foo
   |
   o  12 951b8a83924e dir2/dirB/bar
   |
   o  11 01ae5a51b563 dir2/dirB/foo
   |
   o  10 5eababdf0ac5 dir2/dirA/bar
   |
   o  9 99d690663739 dir2/dirA/foo
   |
   o  8 8e80155d5445 dir1/dirB/bar
   |
   o  7 406760310428 dir1/dirB/foo
   |
   o  6 623466a5f475 dir1/dirA/bar
   |
   o  5 06ff3a5be997 dir1/dirA/foo
   |
   o  4 33227af02764 dir2/bar
   |
   o  3 5e1f9d8d7c69 dir2/foo
   |
   o  2 594bc4b13d4a dir1/bar
   |
   o  1 47f480a08324 dir1/foo
   |
   o  0 2a4f0c3b67da root
   
   $ cd ..
 
 clone a narrow portion of the master, such that we can widen it later
 
   $ hg clone --narrow ssh://user@dummy/master narrow \
   > --include dir1 \
   > --include dir2 \
   > --exclude dir1/dirA \
   > --exclude dir1/dirB \
   > --exclude dir2/dirA \
   > --exclude dir2/dirB
   requesting all changes
   adding changesets
   adding manifests
   adding file changes
   added 6 changesets with 4 changes to 4 files
   new changesets *:* (glob)
   updating to branch default
   4 files updated, 0 files merged, 0 files removed, 0 files unresolved
 
   $ cd narrow
   $ hg tracked
   I path:dir1
   I path:dir2
   X path:dir1/dirA
   X path:dir1/dirB
   X path:dir2/dirA
   X path:dir2/dirB
   $ hg manifest -r tip
   dir1/bar
   dir1/dirA/bar
   dir1/dirA/foo
   dir1/dirB/bar
   dir1/dirB/foo
   dir1/foo
   dir2/bar
   dir2/dirA/bar
   dir2/dirA/foo
   dir2/dirB/bar
   dir2/dirB/foo
   dir2/foo
   root
   $ find * | sort
   dir1
   dir1/bar
   dir1/foo
   dir2
   dir2/bar
   dir2/foo
   $ hg log -G -T '{rev} {node|short}{if(ellipsis, "...")} {files}\n'
   @  5 c87ca422d521... dir1/dirA/foo
   |
   o  4 33227af02764 dir2/bar
   |
   o  3 5e1f9d8d7c69 dir2/foo
   |
   o  2 594bc4b13d4a dir1/bar
   |
   o  1 47f480a08324 dir1/foo
   |
   o  0 2a4f0c3b67da... root
   
 
 widen the narrow checkout
 
   $ hg tracked --removeexclude dir1/dirA
   comparing with ssh://user@dummy/master
   searching for changes
   no changes found
   saved backup bundle to $TESTTMP/narrow/.hg/strip-backup/*-widen.hg (glob)
   adding changesets
   adding manifests
   adding file changes
   added 9 changesets with 6 changes to 6 files
   new changesets *:* (glob)
   $ hg tracked
   I path:dir1
   I path:dir2
   X path:dir1/dirB
   X path:dir2/dirA
   X path:dir2/dirB
   $ find * | sort
   dir1
   dir1/bar
   dir1/dirA
   dir1/dirA/bar
   dir1/dirA/foo
   dir1/foo
   dir2
   dir2/bar
   dir2/foo
 
 #if execbit
   $ test -x dir1/dirA/foo && echo executable
   executable
   $ test -x dir1/dirA/bar || echo not executable
   not executable
 #endif
 
   $ hg log -G -T '{rev} {node|short}{if(ellipsis, "...")} {files}\n'
   @  8 c87ca422d521 dir1/dirA/foo
   |
   o  7 951b8a83924e... dir2/dirB/bar
   |
   o  6 623466a5f475 dir1/dirA/bar
   |
   o  5 06ff3a5be997 dir1/dirA/foo
   |
   o  4 33227af02764 dir2/bar
   |
   o  3 5e1f9d8d7c69 dir2/foo
   |
   o  2 594bc4b13d4a dir1/bar
   |
   o  1 47f480a08324 dir1/foo
   |
   o  0 2a4f0c3b67da... root
   
 
 widen narrow spec again, but exclude a file in previously included spec
 
   $ hg tracked --removeexclude dir2/dirB --addexclude dir1/dirA/bar
   comparing with ssh://user@dummy/master
   searching for changes
   looking for local changes to affected paths
   deleting data/dir1/dirA/bar.i (reporevlogstore !)
   deleting data/dir1/dirA/bar/0eca1d0cbdaea4651d1d04d71976a6d2d9bfaae5 (reposimplestore !)
   deleting data/dir1/dirA/bar/index (reposimplestore !)
   no changes found
   saved backup bundle to $TESTTMP/narrow/.hg/strip-backup/*-widen.hg (glob)
   adding changesets
   adding manifests
   adding file changes
   added 11 changesets with 7 changes to 7 files
   new changesets *:* (glob)
   $ hg tracked
   I path:dir1
   I path:dir2
   X path:dir1/dirA/bar
   X path:dir1/dirB
   X path:dir2/dirA
   $ find * | sort
   dir1
   dir1/bar
   dir1/dirA
   dir1/dirA/foo
   dir1/foo
   dir2
   dir2/bar
   dir2/dirB
   dir2/dirB/bar
   dir2/dirB/foo
   dir2/foo
   $ hg log -G -T '{rev} {node|short}{if(ellipsis, "...")} {files}\n'
   @  10 c87ca422d521 dir1/dirA/foo
   |
   o  9 951b8a83924e dir2/dirB/bar
   |
   o  8 01ae5a51b563 dir2/dirB/foo
   |
   o  7 5eababdf0ac5... dir2/dirA/bar
   |
   o  6 623466a5f475... dir1/dirA/bar
   |
   o  5 06ff3a5be997 dir1/dirA/foo
   |
   o  4 33227af02764 dir2/bar
   |
   o  3 5e1f9d8d7c69 dir2/foo
   |
   o  2 594bc4b13d4a dir1/bar
   |
   o  1 47f480a08324 dir1/foo
   |
   o  0 2a4f0c3b67da... root
   
 
 widen narrow spec yet again, excluding a directory in previous spec
 
   $ hg tracked --removeexclude dir2/dirA --addexclude dir1/dirA
   comparing with ssh://user@dummy/master
   searching for changes
   looking for local changes to affected paths
   deleting data/dir1/dirA/foo.i (reporevlogstore !)
   deleting data/dir1/dirA/foo/162caeb3d55dceb1fee793aa631ac8c73fcb8b5e (reposimplestore !)
   deleting data/dir1/dirA/foo/index (reposimplestore !)
   no changes found
   saved backup bundle to $TESTTMP/narrow/.hg/strip-backup/*-widen.hg (glob)
   adding changesets
   adding manifests
   adding file changes
   added 13 changesets with 8 changes to 8 files
   new changesets *:* (glob)
   $ hg tracked
   I path:dir1
   I path:dir2
   X path:dir1/dirA
   X path:dir1/dirA/bar
   X path:dir1/dirB
   $ find * | sort
   dir1
   dir1/bar
   dir1/foo
   dir2
   dir2/bar
   dir2/dirA
   dir2/dirA/bar
   dir2/dirA/foo
   dir2/dirB
   dir2/dirB/bar
   dir2/dirB/foo
   dir2/foo
   $ hg log -G -T '{rev} {node|short}{if(ellipsis, "...")} {files}\n'
   @  12 c87ca422d521... dir1/dirA/foo
   |
   o  11 951b8a83924e dir2/dirB/bar
   |
   o  10 01ae5a51b563 dir2/dirB/foo
   |
   o  9 5eababdf0ac5 dir2/dirA/bar
   |
   o  8 99d690663739 dir2/dirA/foo
   |
   o  7 8e80155d5445... dir1/dirB/bar
   |
   o  6 623466a5f475... dir1/dirA/bar
   |
   o  5 06ff3a5be997... dir1/dirA/foo
   |
   o  4 33227af02764 dir2/bar
   |
   o  3 5e1f9d8d7c69 dir2/foo
   |
   o  2 594bc4b13d4a dir1/bar
   |
   o  1 47f480a08324 dir1/foo
   |
   o  0 2a4f0c3b67da... root
   
 
 include a directory that was previously explicitly excluded
 
   $ hg tracked --removeexclude dir1/dirA
   comparing with ssh://user@dummy/master
   searching for changes
   no changes found
   saved backup bundle to $TESTTMP/narrow/.hg/strip-backup/*-widen.hg (glob)
   adding changesets
   adding manifests
   adding file changes
   added 13 changesets with 9 changes to 9 files
   new changesets *:* (glob)
   $ hg tracked
   I path:dir1
   I path:dir2
   X path:dir1/dirA/bar
   X path:dir1/dirB
   $ find * | sort
   dir1
   dir1/bar
   dir1/dirA
   dir1/dirA/foo
   dir1/foo
   dir2
   dir2/bar
   dir2/dirA
   dir2/dirA/bar
   dir2/dirA/foo
   dir2/dirB
   dir2/dirB/bar
   dir2/dirB/foo
   dir2/foo
   $ hg log -G -T '{rev} {node|short}{if(ellipsis, "...")} {files}\n'
   @  12 c87ca422d521 dir1/dirA/foo
   |
   o  11 951b8a83924e dir2/dirB/bar
   |
   o  10 01ae5a51b563 dir2/dirB/foo
   |
   o  9 5eababdf0ac5 dir2/dirA/bar
   |
   o  8 99d690663739 dir2/dirA/foo
   |
   o  7 8e80155d5445... dir1/dirB/bar
   |
   o  6 623466a5f475... dir1/dirA/bar
   |
   o  5 06ff3a5be997 dir1/dirA/foo
   |
   o  4 33227af02764 dir2/bar
   |
   o  3 5e1f9d8d7c69 dir2/foo
   |
   o  2 594bc4b13d4a dir1/bar
   |
   o  1 47f480a08324 dir1/foo
   |
   o  0 2a4f0c3b67da... root
   
 
   $ cd ..
 
 clone a narrow portion of the master, such that we can widen it later
 
   $ hg clone --narrow ssh://user@dummy/master narrow2 --include dir1/dirA
   requesting all changes
   adding changesets
   adding manifests
   adding file changes
   added 5 changesets with 2 changes to 2 files
   new changesets *:* (glob)
   updating to branch default
   2 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ cd narrow2
   $ find * | sort
   dir1
   dir1/dirA
   dir1/dirA/bar
   dir1/dirA/foo
   $ hg tracked --addinclude dir1
   comparing with ssh://user@dummy/master
   searching for changes
   no changes found
   saved backup bundle to $TESTTMP/narrow2/.hg/strip-backup/*-widen.hg (glob)
   adding changesets
   adding manifests
   adding file changes
   added 10 changesets with 6 changes to 6 files
   new changesets *:* (glob)
   $ find * | sort
   dir1
   dir1/bar
   dir1/dirA
   dir1/dirA/bar
   dir1/dirA/foo
   dir1/dirB
   dir1/dirB/bar
   dir1/dirB/foo
   dir1/foo
   $ hg log -G -T '{rev} {node|short}{if(ellipsis, "...")} {files}\n'
   @  9 c87ca422d521 dir1/dirA/foo
   |
   o  8 951b8a83924e... dir2/dirB/bar
   |
   o  7 8e80155d5445 dir1/dirB/bar
   |
   o  6 406760310428 dir1/dirB/foo
   |
   o  5 623466a5f475 dir1/dirA/bar
   |
   o  4 06ff3a5be997 dir1/dirA/foo
   |
   o  3 33227af02764... dir2/bar
   |
   o  2 594bc4b13d4a dir1/bar
   |
   o  1 47f480a08324 dir1/foo
   |
   o  0 2a4f0c3b67da... root
   
+
+Illegal patterns are rejected
+
+  $ hg tracked --addinclude glob:**
+  abort: invalid prefix on narrow pattern: glob:**
+  (narrow patterns must begin with one of the following: path:, rootfilesin:)
+  [255]
+
+  $ hg tracked --addexclude set:ignored
+  abort: invalid prefix on narrow pattern: set:ignored
+  (narrow patterns must begin with one of the following: path:, rootfilesin:)
+  [255]