##// END OF EJS Templates
subrepo: set GIT_ALLOW_PROTOCOL to limit git clone protocols (SEC)...
subrepo: set GIT_ALLOW_PROTOCOL to limit git clone protocols (SEC) CVE-2016-3068 (1/1) Git's git-remote-ext remote helper provides an ext:: URL scheme that allows running arbitrary shell commands. This feature allows implementing simple git smart transports with a single shell shell command. However, git submodules could clone arbitrary URLs specified in the .gitmodules file. This was reported as CVE-2015-7545 and fixed in git v2.6.1. However, if a user directly clones a malicious ext URL, the git client will still run arbitrary shell commands. Mercurial is similarly effected. Mercurial allows specifying git repositories as subrepositories. Git ext:: URLs can be specified as Mercurial subrepositories allowing arbitrary shell commands to be run on `hg clone ...`. The Mercurial community would like to thank Blake Burkhart for reporting this issue. The description of the issue is copied from Blake's report. This commit changes submodules to pass the GIT_ALLOW_PROTOCOL env variable to git commands with the same list of allowed protocols that git submodule is using. When the GIT_ALLOW_PROTOCOL env variable is already set, we just pass it to git without modifications.

File last commit:

r25284:7072b91c default
r28658:34d43cb8 stable
Show More
patterns.txt
74 lines | 2.8 KiB | text/plain | TextLexer
Mercurial accepts several notations for identifying one or more files
at a time.
By default, Mercurial treats filenames as shell-style extended glob
patterns.
Alternate pattern notations must be specified explicitly.
.. note::
Patterns specified in ``.hgignore`` are not rooted.
Please see :hg:`help hgignore` for details.
To use a plain path name without any pattern matching, start it with
``path:``. These path names must completely match starting at the
current repository root.
To use an extended glob, start a name with ``glob:``. Globs are rooted
at the current directory; a glob such as ``*.c`` will only match files
in the current directory ending with ``.c``.
The supported glob syntax extensions are ``**`` to match any string
across path separators and ``{a,b}`` to mean "a or b".
To use a Perl/Python regular expression, start a name with ``re:``.
Regexp pattern matching is anchored at the root of the repository.
To read name patterns from a file, use ``listfile:`` or ``listfile0:``.
The latter expects null delimited patterns while the former expects line
feeds. Each string read from the file is itself treated as a file
pattern.
To read a set of patterns from a file, use ``include:`` or ``subinclude:``.
``include:`` will use all the patterns from the given file and treat them as if
they had been passed in manually. ``subinclude:`` will only apply the patterns
against files that are under the subinclude file's directory. See :hg:`help
hgignore` for details on the format of these files.
All patterns, except for ``glob:`` specified in command line (not for
``-I`` or ``-X`` options), can match also against directories: files
under matched directories are treated as matched.
Plain examples::
path:foo/bar a name bar in a directory named foo in the root
of the repository
path:path:name a file or directory named "path:name"
Glob examples::
glob:*.c any name ending in ".c" in the current directory
*.c any name ending in ".c" in the current directory
**.c any name ending in ".c" in any subdirectory of the
current directory including itself.
foo/*.c any name ending in ".c" in the directory foo
foo/**.c any name ending in ".c" in any subdirectory of foo
including itself.
Regexp examples::
re:.*\.c$ any name ending in ".c", anywhere in the repository
File examples::
listfile:list.txt read list from list.txt with one file pattern per line
listfile0:list.txt read list from list.txt with null byte delimiters
See also :hg:`help filesets`.
Include examples::
include:path/to/mypatternfile reads patterns to be applied to all paths
subinclude:path/to/subignorefile reads patterns specifically for paths in the
subdirectory