##// END OF EJS Templates
upstream » mercurial-mirror
RSS

Clone from https://www.mercurial-scm.org/repo/hg-all

sslutil: require TLS 1.1+ when supported...
sslutil: require TLS 1.1+ when supported Currently, Mercurial will use TLS 1.0 or newer when connecting to remote servers, selecting the highest TLS version supported by both peers. On older Pythons, only TLS 1.0 is available. On newer Pythons, TLS 1.1 and 1.2 should be available. Security professionals recommend avoiding TLS 1.0 if possible. PCI DSS 3.1 "strongly encourages" the use of TLS 1.2. Known attacks like BEAST and POODLE exist against TLS 1.0 (although mitigations are available and properly configured servers aren't vulnerable). I asked Eric Rescorla - Mozilla's resident crypto expert - whether Mercurial should drop support for TLS 1.0. His response was "if you can get away with it." Essentially, a number of servers on the Internet don't support TLS 1.1+. This is why web browsers continue to support TLS 1.0 despite desires from security experts. This patch changes Mercurial's default behavior on modern Python versions to require TLS 1.1+, thus avoiding known security issues with TLS 1.0 and making Mercurial more secure by default. Rather than drop TLS 1.0 support wholesale, we still allow TLS 1.0 to be used if configured. This is a compromise solution - ideally we'd disallow TLS 1.0. However, since we're not sure how many Mercurial servers don't support TLS 1.1+ and we're not sure how much user inconvenience this change will bring, I think it is prudent to ship an escape hatch that still allows usage of TLS 1.0. In the default case our users get better security. In the worst case, they are no worse off than before this patch. This patch has no effect when running on Python versions that don't support TLS 1.1+. As the added test shows, connecting to a server that doesn't support TLS 1.1+ will display a warning message with a link to our wiki, where we can guide people to configure their client to allow less secure connections.
Matt Mackall - - Load All Authors

File last commit:

r26421:4b0fc75f default
r29560:303e9300 default
Show More
test-win32text.t
426 lines | 8.3 KiB | text/troff | Tads3Lexer
/ tests / test-win32text.t
History | Annotation | Raw |Copy content |Copy permalink
$ hg init t
$ cd t
$ cat > unix2dos.py <<EOF
> import sys
>
> for path in sys.argv[1:]:
> data = file(path, 'rb').read()
> data = data.replace('\n', '\r\n')
> file(path, 'wb').write(data)
> EOF
$ echo '[hooks]' >> .hg/hgrc
$ echo 'pretxncommit.crlf = python:hgext.win32text.forbidcrlf' >> .hg/hgrc
$ echo 'pretxnchangegroup.crlf = python:hgext.win32text.forbidcrlf' >> .hg/hgrc
$ cat .hg/hgrc
[hooks]
pretxncommit.crlf = python:hgext.win32text.forbidcrlf
pretxnchangegroup.crlf = python:hgext.win32text.forbidcrlf
$ echo hello > f
$ hg add f
commit should succeed
$ hg ci -m 1
$ hg clone . ../zoz
updating to branch default
1 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ cp .hg/hgrc ../zoz/.hg
$ python unix2dos.py f
commit should fail
$ hg ci -m 2.1
attempt to commit or push text file(s) using CRLF line endings
in f583ea08d42a: f
transaction abort!
rollback completed
abort: pretxncommit.crlf hook failed
[255]
$ mv .hg/hgrc .hg/hgrc.bak
commits should succeed
$ hg ci -m 2
$ hg cp f g
$ hg ci -m 2.2
push should fail
$ hg push ../zoz
pushing to ../zoz
searching for changes
adding changesets
adding manifests
adding file changes
added 2 changesets with 2 changes to 2 files
attempt to commit or push text file(s) using CRLF line endings
in bc2d09796734: g
in b1aa5cde7ff4: f
To prevent this mistake in your local repository,
add to Mercurial.ini or .hg/hgrc:
[hooks]
pretxncommit.crlf = python:hgext.win32text.forbidcrlf
and also consider adding:
[extensions]
win32text =
[encode]
** = cleverencode:
[decode]
** = cleverdecode:
transaction abort!
rollback completed
abort: pretxnchangegroup.crlf hook failed
[255]
$ mv .hg/hgrc.bak .hg/hgrc
$ echo hello > f
$ hg rm g
commit should succeed
$ hg ci -m 2.3
push should succeed
$ hg push ../zoz
pushing to ../zoz
searching for changes
adding changesets
adding manifests
adding file changes
added 3 changesets with 3 changes to 2 files
and now for something completely different
$ mkdir d
$ echo hello > d/f2
$ python unix2dos.py d/f2
$ hg add d/f2
$ hg ci -m 3
attempt to commit or push text file(s) using CRLF line endings
in 053ba1a3035a: d/f2
transaction abort!
rollback completed
abort: pretxncommit.crlf hook failed
[255]
$ hg revert -a
forgetting d/f2 (glob)
$ rm d/f2
$ hg rem f
$ hg ci -m 4
$ $PYTHON -c 'file("bin", "wb").write("hello\x00\x0D\x0A")'
$ hg add bin
$ hg ci -m 5
$ hg log -v
changeset: 5:f0b1c8d75fce
tag: tip
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: bin
description:
5
changeset: 4:77796dbcd4ad
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: f
description:
4
changeset: 3:7c1b5430b350
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: f g
description:
2.3
changeset: 2:bc2d09796734
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: g
description:
2.2
changeset: 1:b1aa5cde7ff4
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: f
description:
2
changeset: 0:fcf06d5c4e1d
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: f
description:
1
$ hg clone . dupe
updating to branch default
1 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ for x in a b c d; do echo content > dupe/$x; done
$ hg -R dupe add
adding dupe/a (glob)
adding dupe/b (glob)
adding dupe/c (glob)
adding dupe/d (glob)
$ python unix2dos.py dupe/b dupe/c dupe/d
$ hg -R dupe ci -m a dupe/a
$ hg -R dupe ci -m b/c dupe/[bc]
$ hg -R dupe ci -m d dupe/d
$ hg -R dupe log -v
changeset: 8:67ac5962ab43
tag: tip
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: d
description:
d
changeset: 7:68c127d1834e
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: b c
description:
b/c
changeset: 6:adbf8bf7f31d
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: a
description:
a
changeset: 5:f0b1c8d75fce
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: bin
description:
5
changeset: 4:77796dbcd4ad
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: f
description:
4
changeset: 3:7c1b5430b350
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: f g
description:
2.3
changeset: 2:bc2d09796734
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: g
description:
2.2
changeset: 1:b1aa5cde7ff4
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: f
description:
2
changeset: 0:fcf06d5c4e1d
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: f
description:
1
$ hg pull dupe
pulling from dupe
searching for changes
adding changesets
adding manifests
adding file changes
added 3 changesets with 4 changes to 4 files
attempt to commit or push text file(s) using CRLF line endings
in 67ac5962ab43: d
in 68c127d1834e: b
in 68c127d1834e: c
To prevent this mistake in your local repository,
add to Mercurial.ini or .hg/hgrc:
[hooks]
pretxncommit.crlf = python:hgext.win32text.forbidcrlf
and also consider adding:
[extensions]
win32text =
[encode]
** = cleverencode:
[decode]
** = cleverdecode:
transaction abort!
rollback completed
abort: pretxnchangegroup.crlf hook failed
[255]
$ hg log -v
changeset: 5:f0b1c8d75fce
tag: tip
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: bin
description:
5
changeset: 4:77796dbcd4ad
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: f
description:
4
changeset: 3:7c1b5430b350
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: f g
description:
2.3
changeset: 2:bc2d09796734
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: g
description:
2.2
changeset: 1:b1aa5cde7ff4
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: f
description:
2
changeset: 0:fcf06d5c4e1d
user: test
date: Thu Jan 01 00:00:00 1970 +0000
files: f
description:
1
$ rm .hg/hgrc
$ (echo some; echo text) > f3
$ $PYTHON -c 'file("f4.bat", "wb").write("rem empty\x0D\x0A")'
$ hg add f3 f4.bat
$ hg ci -m 6
$ cat bin
hello\x00\r (esc)
$ cat f3
some
text
$ cat f4.bat
rem empty\r (esc)
$ echo '[extensions]' >> .hg/hgrc
$ echo 'win32text = ' >> .hg/hgrc
$ echo '[decode]' >> .hg/hgrc
$ echo '** = cleverdecode:' >> .hg/hgrc
$ echo '[encode]' >> .hg/hgrc
$ echo '** = cleverencode:' >> .hg/hgrc
$ cat .hg/hgrc
[extensions]
win32text =
[decode]
** = cleverdecode:
[encode]
** = cleverencode:
Trigger deprecation warning:
$ hg id -t
win32text is deprecated: https://mercurial-scm.org/wiki/Win32TextExtension
tip
Disable warning:
$ echo '[win32text]' >> .hg/hgrc
$ echo 'warn = no' >> .hg/hgrc
$ hg id -t
tip
$ rm f3 f4.bat bin
$ hg co -C
WARNING: f4.bat already has CRLF line endings
and does not need EOL conversion by the win32text plugin.
Before your next commit, please reconsider your encode/decode settings in
Mercurial.ini or $TESTTMP/t/.hg/hgrc. (glob)
3 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ cat bin
hello\x00\r (esc)
$ cat f3
some\r (esc)
text\r (esc)
$ cat f4.bat
rem empty\r (esc)
$ $PYTHON -c 'file("f5.sh", "wb").write("# empty\x0D\x0A")'
$ hg add f5.sh
$ hg ci -m 7
$ cat f5.sh
# empty\r (esc)
$ hg cat f5.sh
# empty
$ echo '% just linefeed' > linefeed
$ hg ci -qAm 8 linefeed
$ cat linefeed
% just linefeed
$ hg cat linefeed
% just linefeed
$ hg st -q
$ hg revert -a linefeed
no changes needed to linefeed
$ cat linefeed
% just linefeed
$ hg st -q
$ echo modified >> linefeed
$ hg st -q
M linefeed
$ hg revert -a
reverting linefeed
$ hg st -q
$ cat linefeed
% just linefeed\r (esc)
$ cd ..