ssh: ban any username@host or host that starts with - (SEC)

This paranoia probably isn't required, but it can't hurt either.

mercurial/posix.py

@@ -1,668 +1,672 b''
 # posix.py - Posix utility function implementations for Mercurial
 #
 #  Copyright 2005-2009 Matt Mackall <[e-mail]> and others
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 from __future__ import absolute_import
 
 import errno
 import fcntl
 import getpass
 import grp
 import os
 import pwd
 import re
 import select
 import stat
 import sys
 import tempfile
 import unicodedata
 
 from .i18n import _
 from . import (
     encoding,
+    error,
     pycompat,
 )
 
 posixfile = open
 normpath = os.path.normpath
 samestat = os.path.samestat
 try:
     oslink = os.link
 except AttributeError:
     # Some platforms build Python without os.link on systems that are
     # vaguely unix-like but don't have hardlink support. For those
     # poor souls, just say we tried and that it failed so we fall back
     # to copies.
     def oslink(src, dst):
         raise OSError(errno.EINVAL,
                       'hardlinks not supported: %s to %s' % (src, dst))
 unlink = os.unlink
 rename = os.rename
 removedirs = os.removedirs
 expandglobs = False
 
 umask = os.umask(0)
 os.umask(umask)
 
 def split(p):
     '''Same as posixpath.split, but faster
 
     >>> import posixpath
     >>> for f in ['/absolute/path/to/file',
     ...           'relative/path/to/file',
     ...           'file_alone',
     ...           'path/to/directory/',
     ...           '/multiple/path//separators',
     ...           '/file_at_root',
     ...           '///multiple_leading_separators_at_root',
     ...           '']:
     ...     assert split(f) == posixpath.split(f), f
     '''
     ht = p.rsplit('/', 1)
     if len(ht) == 1:
         return '', p
     nh = ht[0].rstrip('/')
     if nh:
         return nh, ht[1]
     return ht[0] + '/', ht[1]
 
 def openhardlinks():
     '''return true if it is safe to hold open file handles to hardlinks'''
     return True
 
 def nlinks(name):
     '''return number of hardlinks for the given file'''
     return os.lstat(name).st_nlink
 
 def parsepatchoutput(output_line):
     """parses the output produced by patch and returns the filename"""
     pf = output_line[14:]
     if pycompat.sysplatform == 'OpenVMS':
         if pf[0] == '`':
             pf = pf[1:-1] # Remove the quotes
     else:
         if pf.startswith("'") and pf.endswith("'") and " " in pf:
             pf = pf[1:-1] # Remove the quotes
     return pf
 
 def sshargs(sshcmd, host, user, port):
     '''Build argument list for ssh'''
     args = user and ("%s@%s" % (user, host)) or host
+    if '-' in args[:2]:
+        raise error.Abort(
+            _('illegal ssh hostname or username starting with -: %s') % args)
     return port and ("%s -p %s" % (args, port)) or args
 
 def isexec(f):
     """check whether a file is executable"""
     return (os.lstat(f).st_mode & 0o100 != 0)
 
 def setflags(f, l, x):
     st = os.lstat(f)
     s = st.st_mode
     if l:
         if not stat.S_ISLNK(s):
             # switch file to link
             fp = open(f)
             data = fp.read()
             fp.close()
             unlink(f)
             try:
                 os.symlink(data, f)
             except OSError:
                 # failed to make a link, rewrite file
                 fp = open(f, "w")
                 fp.write(data)
                 fp.close()
         # no chmod needed at this point
         return
     if stat.S_ISLNK(s):
         # switch link to file
         data = os.readlink(f)
         unlink(f)
         fp = open(f, "w")
         fp.write(data)
         fp.close()
         s = 0o666 & ~umask # avoid restatting for chmod
 
     sx = s & 0o100
     if st.st_nlink > 1 and bool(x) != bool(sx):
         # the file is a hardlink, break it
         with open(f, "rb") as fp:
             data = fp.read()
         unlink(f)
         with open(f, "wb") as fp:
             fp.write(data)
 
     if x and not sx:
         # Turn on +x for every +r bit when making a file executable
         # and obey umask.
         os.chmod(f, s | (s & 0o444) >> 2 & ~umask)
     elif not x and sx:
         # Turn off all +x bits
         os.chmod(f, s & 0o666)
 
 def copymode(src, dst, mode=None):
     '''Copy the file mode from the file at path src to dst.
     If src doesn't exist, we're using mode instead. If mode is None, we're
     using umask.'''
     try:
         st_mode = os.lstat(src).st_mode & 0o777
     except OSError as inst:
         if inst.errno != errno.ENOENT:
             raise
         st_mode = mode
         if st_mode is None:
             st_mode = ~umask
         st_mode &= 0o666
     os.chmod(dst, st_mode)
 
 def checkexec(path):
     """
     Check whether the given path is on a filesystem with UNIX-like exec flags
 
     Requires a directory (like /foo/.hg)
     """
 
     # VFAT on some Linux versions can flip mode but it doesn't persist
     # a FS remount. Frequently we can detect it if files are created
     # with exec bit on.
 
     try:
         EXECFLAGS = stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH
         cachedir = os.path.join(path, '.hg', 'cache')
         if os.path.isdir(cachedir):
             checkisexec = os.path.join(cachedir, 'checkisexec')
             checknoexec = os.path.join(cachedir, 'checknoexec')
 
             try:
                 m = os.stat(checkisexec).st_mode
             except OSError as e:
                 if e.errno != errno.ENOENT:
                     raise
                 # checkisexec does not exist - fall through ...
             else:
                 # checkisexec exists, check if it actually is exec
                 if m & EXECFLAGS != 0:
                     # ensure checkisexec exists, check it isn't exec
                     try:
                         m = os.stat(checknoexec).st_mode
                     except OSError as e:
                         if e.errno != errno.ENOENT:
                             raise
                         open(checknoexec, 'w').close() # might fail
                         m = os.stat(checknoexec).st_mode
                     if m & EXECFLAGS == 0:
                         # check-exec is exec and check-no-exec is not exec
                         return True
                     # checknoexec exists but is exec - delete it
                     unlink(checknoexec)
                 # checkisexec exists but is not exec - delete it
                 unlink(checkisexec)
 
             # check using one file, leave it as checkisexec
             checkdir = cachedir
         else:
             # check directly in path and don't leave checkisexec behind
             checkdir = path
             checkisexec = None
         fh, fn = tempfile.mkstemp(dir=checkdir, prefix='hg-checkexec-')
         try:
             os.close(fh)
             m = os.stat(fn).st_mode
             if m & EXECFLAGS == 0:
                 os.chmod(fn, m & 0o777 | EXECFLAGS)
                 if os.stat(fn).st_mode & EXECFLAGS != 0:
                     if checkisexec is not None:
                         os.rename(fn, checkisexec)
                         fn = None
                     return True
         finally:
             if fn is not None:
                 unlink(fn)
     except (IOError, OSError):
         # we don't care, the user probably won't be able to commit anyway
         return False
 
 def checklink(path):
     """check whether the given path is on a symlink-capable filesystem"""
     # mktemp is not racy because symlink creation will fail if the
     # file already exists
     while True:
         cachedir = os.path.join(path, '.hg', 'cache')
         checklink = os.path.join(cachedir, 'checklink')
         # try fast path, read only
         if os.path.islink(checklink):
             return True
         if os.path.isdir(cachedir):
             checkdir = cachedir
         else:
             checkdir = path
             cachedir = None
         fscheckdir = pycompat.fsdecode(checkdir)
         name = tempfile.mktemp(dir=fscheckdir,
                                prefix=r'checklink-')
         name = pycompat.fsencode(name)
         try:
             fd = None
             if cachedir is None:
                 fd = tempfile.NamedTemporaryFile(dir=fscheckdir,
                                                  prefix=r'hg-checklink-')
                 target = pycompat.fsencode(os.path.basename(fd.name))
             else:
                 # create a fixed file to link to; doesn't matter if it
                 # already exists.
                 target = 'checklink-target'
                 try:
                     open(os.path.join(cachedir, target), 'w').close()
                 except IOError as inst:
                     if inst[0] == errno.EACCES:
                         # If we can't write to cachedir, just pretend
                         # that the fs is readonly and by association
                         # that the fs won't support symlinks. This
                         # seems like the least dangerous way to avoid
                         # data loss.
                         return False
                     raise
             try:
                 os.symlink(target, name)
                 if cachedir is None:
                     unlink(name)
                 else:
                     try:
                         os.rename(name, checklink)
                     except OSError:
                         unlink(name)
                 return True
             except OSError as inst:
                 # link creation might race, try again
                 if inst[0] == errno.EEXIST:
                     continue
                 raise
             finally:
                 if fd is not None:
                     fd.close()
         except AttributeError:
             return False
         except OSError as inst:
             # sshfs might report failure while successfully creating the link
             if inst[0] == errno.EIO and os.path.exists(name):
                 unlink(name)
             return False
 
 def checkosfilename(path):
     '''Check that the base-relative path is a valid filename on this platform.
     Returns None if the path is ok, or a UI string describing the problem.'''
     pass # on posix platforms, every path is ok
 
 def setbinary(fd):
     pass
 
 def pconvert(path):
     return path
 
 def localpath(path):
     return path
 
 def samefile(fpath1, fpath2):
     """Returns whether path1 and path2 refer to the same file. This is only
     guaranteed to work for files, not directories."""
     return os.path.samefile(fpath1, fpath2)
 
 def samedevice(fpath1, fpath2):
     """Returns whether fpath1 and fpath2 are on the same device. This is only
     guaranteed to work for files, not directories."""
     st1 = os.lstat(fpath1)
     st2 = os.lstat(fpath2)
     return st1.st_dev == st2.st_dev
 
 # os.path.normcase is a no-op, which doesn't help us on non-native filesystems
 def normcase(path):
     return path.lower()
 
 # what normcase does to ASCII strings
 normcasespec = encoding.normcasespecs.lower
 # fallback normcase function for non-ASCII strings
 normcasefallback = normcase
 
 if pycompat.sysplatform == 'darwin':
 
     def normcase(path):
         '''
         Normalize a filename for OS X-compatible comparison:
         - escape-encode invalid characters
         - decompose to NFD
         - lowercase
         - omit ignored characters [200c-200f, 202a-202e, 206a-206f,feff]
 
         >>> normcase('UPPER')
         'upper'
         >>> normcase('Caf\xc3\xa9')
         'cafe\\xcc\\x81'
         >>> normcase('\xc3\x89')
         'e\\xcc\\x81'
         >>> normcase('\xb8\xca\xc3\xca\xbe\xc8.JPG') # issue3918
         '%b8%ca%c3\\xca\\xbe%c8.jpg'
         '''
 
         try:
             return encoding.asciilower(path)  # exception for non-ASCII
         except UnicodeDecodeError:
             return normcasefallback(path)
 
     normcasespec = encoding.normcasespecs.lower
 
     def normcasefallback(path):
         try:
             u = path.decode('utf-8')
         except UnicodeDecodeError:
             # OS X percent-encodes any bytes that aren't valid utf-8
             s = ''
             pos = 0
             l = len(path)
             while pos < l:
                 try:
                     c = encoding.getutf8char(path, pos)
                     pos += len(c)
                 except ValueError:
                     c = '%%%02X' % ord(path[pos])
                     pos += 1
                 s += c
 
             u = s.decode('utf-8')
 
         # Decompose then lowercase (HFS+ technote specifies lower)
         enc = unicodedata.normalize('NFD', u).lower().encode('utf-8')
         # drop HFS+ ignored characters
         return encoding.hfsignoreclean(enc)
 
 if pycompat.sysplatform == 'cygwin':
     # workaround for cygwin, in which mount point part of path is
     # treated as case sensitive, even though underlying NTFS is case
     # insensitive.
 
     # default mount points
     cygwinmountpoints = sorted([
             "/usr/bin",
             "/usr/lib",
             "/cygdrive",
             ], reverse=True)
 
     # use upper-ing as normcase as same as NTFS workaround
     def normcase(path):
         pathlen = len(path)
         if (pathlen == 0) or (path[0] != pycompat.ossep):
             # treat as relative
             return encoding.upper(path)
 
         # to preserve case of mountpoint part
         for mp in cygwinmountpoints:
             if not path.startswith(mp):
                 continue
 
             mplen = len(mp)
             if mplen == pathlen: # mount point itself
                 return mp
             if path[mplen] == pycompat.ossep:
                 return mp + encoding.upper(path[mplen:])
 
         return encoding.upper(path)
 
     normcasespec = encoding.normcasespecs.other
     normcasefallback = normcase
 
     # Cygwin translates native ACLs to POSIX permissions,
     # but these translations are not supported by native
     # tools, so the exec bit tends to be set erroneously.
     # Therefore, disable executable bit access on Cygwin.
     def checkexec(path):
         return False
 
     # Similarly, Cygwin's symlink emulation is likely to create
     # problems when Mercurial is used from both Cygwin and native
     # Windows, with other native tools, or on shared volumes
     def checklink(path):
         return False
 
 _needsshellquote = None
 def shellquote(s):
     if pycompat.sysplatform == 'OpenVMS':
         return '"%s"' % s
     global _needsshellquote
     if _needsshellquote is None:
         _needsshellquote = re.compile(br'[^a-zA-Z0-9._/+-]').search
     if s and not _needsshellquote(s):
         # "s" shouldn't have to be quoted
         return s
     else:
         return "'%s'" % s.replace("'", "'\\''")
 
 def quotecommand(cmd):
     return cmd
 
 def popen(command, mode='r'):
     return os.popen(command, mode)
 
 def testpid(pid):
     '''return False if pid dead, True if running or not sure'''
     if pycompat.sysplatform == 'OpenVMS':
         return True
     try:
         os.kill(pid, 0)
         return True
     except OSError as inst:
         return inst.errno != errno.ESRCH
 
 def explainexit(code):
     """return a 2-tuple (desc, code) describing a subprocess status
     (codes from kill are negative - not os.system/wait encoding)"""
     if code >= 0:
         return _("exited with status %d") % code, code
     return _("killed by signal %d") % -code, -code
 
 def isowner(st):
     """Return True if the stat object st is from the current user."""
     return st.st_uid == os.getuid()
 
 def findexe(command):
     '''Find executable for command searching like which does.
     If command is a basename then PATH is searched for command.
     PATH isn't searched if command is an absolute or relative path.
     If command isn't found None is returned.'''
     if pycompat.sysplatform == 'OpenVMS':
         return command
 
     def findexisting(executable):
         'Will return executable if existing file'
         if os.path.isfile(executable) and os.access(executable, os.X_OK):
             return executable
         return None
 
     if pycompat.ossep in command:
         return findexisting(command)
 
     if pycompat.sysplatform == 'plan9':
         return findexisting(os.path.join('/bin', command))
 
     for path in encoding.environ.get('PATH', '').split(pycompat.ospathsep):
         executable = findexisting(os.path.join(path, command))
         if executable is not None:
             return executable
     return None
 
 def setsignalhandler():
     pass
 
 _wantedkinds = {stat.S_IFREG, stat.S_IFLNK}
 
 def statfiles(files):
     '''Stat each file in files. Yield each stat, or None if a file does not
     exist or has a type we don't care about.'''
     lstat = os.lstat
     getkind = stat.S_IFMT
     for nf in files:
         try:
             st = lstat(nf)
             if getkind(st.st_mode) not in _wantedkinds:
                 st = None
         except OSError as err:
             if err.errno not in (errno.ENOENT, errno.ENOTDIR):
                 raise
             st = None
         yield st
 
 def getuser():
     '''return name of current user'''
     return pycompat.fsencode(getpass.getuser())
 
 def username(uid=None):
     """Return the name of the user with the given uid.
 
     If uid is None, return the name of the current user."""
 
     if uid is None:
         uid = os.getuid()
     try:
         return pwd.getpwuid(uid)[0]
     except KeyError:
         return str(uid)
 
 def groupname(gid=None):
     """Return the name of the group with the given gid.
 
     If gid is None, return the name of the current group."""
 
     if gid is None:
         gid = os.getgid()
     try:
         return grp.getgrgid(gid)[0]
     except KeyError:
         return str(gid)
 
 def groupmembers(name):
     """Return the list of members of the group with the given
     name, KeyError if the group does not exist.
     """
     return list(grp.getgrnam(name).gr_mem)
 
 def spawndetached(args):
     return os.spawnvp(os.P_NOWAIT | getattr(os, 'P_DETACH', 0),
                       args[0], args)
 
 def gethgcmd():
     return sys.argv[:1]
 
 def makedir(path, notindexed):
     os.mkdir(path)
 
 def lookupreg(key, name=None, scope=None):
     return None
 
 def hidewindow():
     """Hide current shell window.
 
     Used to hide the window opened when starting asynchronous
     child process under Windows, unneeded on other systems.
     """
     pass
 
 class cachestat(object):
     def __init__(self, path):
         self.stat = os.stat(path)
 
     def cacheable(self):
         return bool(self.stat.st_ino)
 
     __hash__ = object.__hash__
 
     def __eq__(self, other):
         try:
             # Only dev, ino, size, mtime and atime are likely to change. Out
             # of these, we shouldn't compare atime but should compare the
             # rest. However, one of the other fields changing indicates
             # something fishy going on, so return False if anything but atime
             # changes.
             return (self.stat.st_mode == other.stat.st_mode and
                     self.stat.st_ino == other.stat.st_ino and
                     self.stat.st_dev == other.stat.st_dev and
                     self.stat.st_nlink == other.stat.st_nlink and
                     self.stat.st_uid == other.stat.st_uid and
                     self.stat.st_gid == other.stat.st_gid and
                     self.stat.st_size == other.stat.st_size and
                     self.stat.st_mtime == other.stat.st_mtime and
                     self.stat.st_ctime == other.stat.st_ctime)
         except AttributeError:
             return False
 
     def __ne__(self, other):
         return not self == other
 
 def executablepath():
     return None # available on Windows only
 
 def statislink(st):
     '''check whether a stat result is a symlink'''
     return st and stat.S_ISLNK(st.st_mode)
 
 def statisexec(st):
     '''check whether a stat result is an executable file'''
     return st and (st.st_mode & 0o100 != 0)
 
 def poll(fds):
     """block until something happens on any file descriptor
 
     This is a generic helper that will check for any activity
     (read, write.  exception) and return the list of touched files.
 
     In unsupported cases, it will raise a NotImplementedError"""
     try:
         while True:
             try:
                 res = select.select(fds, fds, fds)
                 break
             except select.error as inst:
                 if inst.args[0] == errno.EINTR:
                     continue
                 raise
     except ValueError: # out of range file descriptor
         raise NotImplementedError()
     return sorted(list(set(sum(res, []))))
 
 def readpipe(pipe):
     """Read all available data from a pipe."""
     # We can't fstat() a pipe because Linux will always report 0.
     # So, we set the pipe to non-blocking mode and read everything
     # that's available.
     flags = fcntl.fcntl(pipe, fcntl.F_GETFL)
     flags |= os.O_NONBLOCK
     oldflags = fcntl.fcntl(pipe, fcntl.F_SETFL, flags)
 
     try:
         chunks = []
         while True:
             try:
                 s = pipe.read()
                 if not s:
                     break
                 chunks.append(s)
             except IOError:
                 break
 
         return ''.join(chunks)
     finally:
         fcntl.fcntl(pipe, fcntl.F_SETFL, oldflags)
 
 def bindunixsocket(sock, path):
     """Bind the UNIX domain socket to the specified path"""
     # use relative path instead of full path at bind() if possible, since
     # AF_UNIX path has very small length limit (107 chars) on common
     # platforms (see sys/un.h)
     dirname, basename = os.path.split(path)
     bakwdfd = None
     if dirname:
         bakwdfd = os.open('.', os.O_DIRECTORY)
         os.chdir(dirname)
     sock.bind(basename)
     if bakwdfd:
         os.fchdir(bakwdfd)
         os.close(bakwdfd)

mercurial/windows.py

@@ -1,476 +1,481 b''
 # windows.py - Windows utility function implementations for Mercurial
 #
 #  Copyright 2005-2009 Matt Mackall <[e-mail]> and others
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 from __future__ import absolute_import
 
 import errno
 import msvcrt
 import os
 import re
 import stat
 import sys
 
 from .i18n import _
 from . import (
     encoding,
+    error,
     policy,
     pycompat,
     win32,
 )
 
 try:
     import _winreg as winreg
     winreg.CloseKey
 except ImportError:
     import winreg
 
 osutil = policy.importmod(r'osutil')
 
 executablepath = win32.executablepath
 getuser = win32.getuser
 hidewindow = win32.hidewindow
 makedir = win32.makedir
 nlinks = win32.nlinks
 oslink = win32.oslink
 samedevice = win32.samedevice
 samefile = win32.samefile
 setsignalhandler = win32.setsignalhandler
 spawndetached = win32.spawndetached
 split = os.path.split
 testpid = win32.testpid
 unlink = win32.unlink
 
 umask = 0o022
 
 class mixedfilemodewrapper(object):
     """Wraps a file handle when it is opened in read/write mode.
 
     fopen() and fdopen() on Windows have a specific-to-Windows requirement
     that files opened with mode r+, w+, or a+ make a call to a file positioning
     function when switching between reads and writes. Without this extra call,
     Python will raise a not very intuitive "IOError: [Errno 0] Error."
 
     This class wraps posixfile instances when the file is opened in read/write
     mode and automatically adds checks or inserts appropriate file positioning
     calls when necessary.
     """
     OPNONE = 0
     OPREAD = 1
     OPWRITE = 2
 
     def __init__(self, fp):
         object.__setattr__(self, r'_fp', fp)
         object.__setattr__(self, r'_lastop', 0)
 
     def __enter__(self):
         return self._fp.__enter__()
 
     def __exit__(self, exc_type, exc_val, exc_tb):
         self._fp.__exit__(exc_type, exc_val, exc_tb)
 
     def __getattr__(self, name):
         return getattr(self._fp, name)
 
     def __setattr__(self, name, value):
         return self._fp.__setattr__(name, value)
 
     def _noopseek(self):
         self._fp.seek(0, os.SEEK_CUR)
 
     def seek(self, *args, **kwargs):
         object.__setattr__(self, r'_lastop', self.OPNONE)
         return self._fp.seek(*args, **kwargs)
 
     def write(self, d):
         if self._lastop == self.OPREAD:
             self._noopseek()
 
         object.__setattr__(self, r'_lastop', self.OPWRITE)
         return self._fp.write(d)
 
     def writelines(self, *args, **kwargs):
         if self._lastop == self.OPREAD:
             self._noopeseek()
 
         object.__setattr__(self, r'_lastop', self.OPWRITE)
         return self._fp.writelines(*args, **kwargs)
 
     def read(self, *args, **kwargs):
         if self._lastop == self.OPWRITE:
             self._noopseek()
 
         object.__setattr__(self, r'_lastop', self.OPREAD)
         return self._fp.read(*args, **kwargs)
 
     def readline(self, *args, **kwargs):
         if self._lastop == self.OPWRITE:
             self._noopseek()
 
         object.__setattr__(self, r'_lastop', self.OPREAD)
         return self._fp.readline(*args, **kwargs)
 
     def readlines(self, *args, **kwargs):
         if self._lastop == self.OPWRITE:
             self._noopseek()
 
         object.__setattr__(self, r'_lastop', self.OPREAD)
         return self._fp.readlines(*args, **kwargs)
 
 def posixfile(name, mode='r', buffering=-1):
     '''Open a file with even more POSIX-like semantics'''
     try:
         fp = osutil.posixfile(name, mode, buffering) # may raise WindowsError
 
         # The position when opening in append mode is implementation defined, so
         # make it consistent with other platforms, which position at EOF.
         if 'a' in mode:
             fp.seek(0, os.SEEK_END)
 
         if '+' in mode:
             return mixedfilemodewrapper(fp)
 
         return fp
     except WindowsError as err:
         # convert to a friendlier exception
         raise IOError(err.errno, '%s: %s' % (name, err.strerror))
 
 # may be wrapped by win32mbcs extension
 listdir = osutil.listdir
 
 class winstdout(object):
     '''stdout on windows misbehaves if sent through a pipe'''
 
     def __init__(self, fp):
         self.fp = fp
 
     def __getattr__(self, key):
         return getattr(self.fp, key)
 
     def close(self):
         try:
             self.fp.close()
         except IOError:
             pass
 
     def write(self, s):
         try:
             # This is workaround for "Not enough space" error on
             # writing large size of data to console.
             limit = 16000
             l = len(s)
             start = 0
             self.softspace = 0
             while start < l:
                 end = start + limit
                 self.fp.write(s[start:end])
                 start = end
         except IOError as inst:
             if inst.errno != 0:
                 raise
             self.close()
             raise IOError(errno.EPIPE, 'Broken pipe')
 
     def flush(self):
         try:
             return self.fp.flush()
         except IOError as inst:
             if inst.errno != errno.EINVAL:
                 raise
             raise IOError(errno.EPIPE, 'Broken pipe')
 
 def _is_win_9x():
     '''return true if run on windows 95, 98 or me.'''
     try:
         return sys.getwindowsversion()[3] == 1
     except AttributeError:
         return 'command' in encoding.environ.get('comspec', '')
 
 def openhardlinks():
     return not _is_win_9x()
 
 def parsepatchoutput(output_line):
     """parses the output produced by patch and returns the filename"""
     pf = output_line[14:]
     if pf[0] == '`':
         pf = pf[1:-1] # Remove the quotes
     return pf
 
 def sshargs(sshcmd, host, user, port):
     '''Build argument list for ssh or Plink'''
     pflag = 'plink' in sshcmd.lower() and '-P' or '-p'
     args = user and ("%s@%s" % (user, host)) or host
+    if args.startswith('-') or args.startswith('/'):
+        raise error.Abort(
+            _('illegal ssh hostname or username starting with - or /: %s') %
+            args)
     return port and ("%s %s %s" % (args, pflag, port)) or args
 
 def setflags(f, l, x):
     pass
 
 def copymode(src, dst, mode=None):
     pass
 
 def checkexec(path):
     return False
 
 def checklink(path):
     return False
 
 def setbinary(fd):
     # When run without console, pipes may expose invalid
     # fileno(), usually set to -1.
     fno = getattr(fd, 'fileno', None)
     if fno is not None and fno() >= 0:
         msvcrt.setmode(fno(), os.O_BINARY)
 
 def pconvert(path):
     return path.replace(pycompat.ossep, '/')
 
 def localpath(path):
     return path.replace('/', '\\')
 
 def normpath(path):
     return pconvert(os.path.normpath(path))
 
 def normcase(path):
     return encoding.upper(path) # NTFS compares via upper()
 
 # see posix.py for definitions
 normcasespec = encoding.normcasespecs.upper
 normcasefallback = encoding.upperfallback
 
 def samestat(s1, s2):
     return False
 
 # A sequence of backslashes is special iff it precedes a double quote:
 # - if there's an even number of backslashes, the double quote is not
 #   quoted (i.e. it ends the quoted region)
 # - if there's an odd number of backslashes, the double quote is quoted
 # - in both cases, every pair of backslashes is unquoted into a single
 #   backslash
 # (See http://msdn2.microsoft.com/en-us/library/a1y7w461.aspx )
 # So, to quote a string, we must surround it in double quotes, double
 # the number of backslashes that precede double quotes and add another
 # backslash before every double quote (being careful with the double
 # quote we've appended to the end)
 _quotere = None
 _needsshellquote = None
 def shellquote(s):
     r"""
     >>> shellquote(r'C:\Users\xyz')
     '"C:\\Users\\xyz"'
     >>> shellquote(r'C:\Users\xyz/mixed')
     '"C:\\Users\\xyz/mixed"'
     >>> # Would be safe not to quote too, since it is all double backslashes
     >>> shellquote(r'C:\\Users\\xyz')
     '"C:\\\\Users\\\\xyz"'
     >>> # But this must be quoted
     >>> shellquote(r'C:\\Users\\xyz/abc')
     '"C:\\\\Users\\\\xyz/abc"'
     """
     global _quotere
     if _quotere is None:
         _quotere = re.compile(r'(\\*)("|\\$)')
     global _needsshellquote
     if _needsshellquote is None:
         # ":" is also treated as "safe character", because it is used as a part
         # of path name on Windows.  "\" is also part of a path name, but isn't
         # safe because shlex.split() (kind of) treats it as an escape char and
         # drops it.  It will leave the next character, even if it is another
         # "\".
         _needsshellquote = re.compile(r'[^a-zA-Z0-9._:/-]').search
     if s and not _needsshellquote(s) and not _quotere.search(s):
         # "s" shouldn't have to be quoted
         return s
     return '"%s"' % _quotere.sub(r'\1\1\\\2', s)
 
 def quotecommand(cmd):
     """Build a command string suitable for os.popen* calls."""
     if sys.version_info < (2, 7, 1):
         # Python versions since 2.7.1 do this extra quoting themselves
         return '"' + cmd + '"'
     return cmd
 
 def popen(command, mode='r'):
     # Work around "popen spawned process may not write to stdout
     # under windows"
     # http://bugs.python.org/issue1366
     command += " 2> %s" % os.devnull
     return os.popen(quotecommand(command), mode)
 
 def explainexit(code):
     return _("exited with status %d") % code, code
 
 # if you change this stub into a real check, please try to implement the
 # username and groupname functions above, too.
 def isowner(st):
     return True
 
 def findexe(command):
     '''Find executable for command searching like cmd.exe does.
     If command is a basename then PATH is searched for command.
     PATH isn't searched if command is an absolute or relative path.
     An extension from PATHEXT is found and added if not present.
     If command isn't found None is returned.'''
     pathext = encoding.environ.get('PATHEXT', '.COM;.EXE;.BAT;.CMD')
     pathexts = [ext for ext in pathext.lower().split(pycompat.ospathsep)]
     if os.path.splitext(command)[1].lower() in pathexts:
         pathexts = ['']
 
     def findexisting(pathcommand):
         'Will append extension (if needed) and return existing file'
         for ext in pathexts:
             executable = pathcommand + ext
             if os.path.exists(executable):
                 return executable
         return None
 
     if pycompat.ossep in command:
         return findexisting(command)
 
     for path in encoding.environ.get('PATH', '').split(pycompat.ospathsep):
         executable = findexisting(os.path.join(path, command))
         if executable is not None:
             return executable
     return findexisting(os.path.expanduser(os.path.expandvars(command)))
 
 _wantedkinds = {stat.S_IFREG, stat.S_IFLNK}
 
 def statfiles(files):
     '''Stat each file in files. Yield each stat, or None if a file
     does not exist or has a type we don't care about.
 
     Cluster and cache stat per directory to minimize number of OS stat calls.'''
     dircache = {} # dirname -> filename -> status | None if file does not exist
     getkind = stat.S_IFMT
     for nf in files:
         nf  = normcase(nf)
         dir, base = os.path.split(nf)
         if not dir:
             dir = '.'
         cache = dircache.get(dir, None)
         if cache is None:
             try:
                 dmap = dict([(normcase(n), s)
                              for n, k, s in listdir(dir, True)
                              if getkind(s.st_mode) in _wantedkinds])
             except OSError as err:
                 # Python >= 2.5 returns ENOENT and adds winerror field
                 # EINVAL is raised if dir is not a directory.
                 if err.errno not in (errno.ENOENT, errno.EINVAL,
                                      errno.ENOTDIR):
                     raise
                 dmap = {}
             cache = dircache.setdefault(dir, dmap)
         yield cache.get(base, None)
 
 def username(uid=None):
     """Return the name of the user with the given uid.
 
     If uid is None, return the name of the current user."""
     return None
 
 def groupname(gid=None):
     """Return the name of the group with the given gid.
 
     If gid is None, return the name of the current group."""
     return None
 
 def removedirs(name):
     """special version of os.removedirs that does not remove symlinked
     directories or junction points if they actually contain files"""
     if listdir(name):
         return
     os.rmdir(name)
     head, tail = os.path.split(name)
     if not tail:
         head, tail = os.path.split(head)
     while head and tail:
         try:
             if listdir(head):
                 return
             os.rmdir(head)
         except (ValueError, OSError):
             break
         head, tail = os.path.split(head)
 
 def rename(src, dst):
     '''atomically rename file src to dst, replacing dst if it exists'''
     try:
         os.rename(src, dst)
     except OSError as e:
         if e.errno != errno.EEXIST:
             raise
         unlink(dst)
         os.rename(src, dst)
 
 def gethgcmd():
     return [sys.executable] + sys.argv[:1]
 
 def groupmembers(name):
     # Don't support groups on Windows for now
     raise KeyError
 
 def isexec(f):
     return False
 
 class cachestat(object):
     def __init__(self, path):
         pass
 
     def cacheable(self):
         return False
 
 def lookupreg(key, valname=None, scope=None):
     ''' Look up a key/value name in the Windows registry.
 
     valname: value name. If unspecified, the default value for the key
     is used.
     scope: optionally specify scope for registry lookup, this can be
     a sequence of scopes to look up in order. Default (CURRENT_USER,
     LOCAL_MACHINE).
     '''
     if scope is None:
         scope = (winreg.HKEY_CURRENT_USER, winreg.HKEY_LOCAL_MACHINE)
     elif not isinstance(scope, (list, tuple)):
         scope = (scope,)
     for s in scope:
         try:
             val = winreg.QueryValueEx(winreg.OpenKey(s, key), valname)[0]
             # never let a Unicode string escape into the wild
             return encoding.unitolocal(val)
         except EnvironmentError:
             pass
 
 expandglobs = True
 
 def statislink(st):
     '''check whether a stat result is a symlink'''
     return False
 
 def statisexec(st):
     '''check whether a stat result is an executable file'''
     return False
 
 def poll(fds):
     # see posix.py for description
     raise NotImplementedError()
 
 def readpipe(pipe):
     """Read all available data from a pipe."""
     chunks = []
     while True:
         size = win32.peekpipe(pipe)
         if not size:
             break
 
         s = pipe.read(size)
         if not s:
             break
         chunks.append(s)
 
     return ''.join(chunks)
 
 def bindunixsocket(sock, path):
     raise NotImplementedError('unsupported platform')