##// END OF EJS Templates
dispatch: protect against malicious 'hg serve --stdio' invocations (sec)...
dispatch: protect against malicious 'hg serve --stdio' invocations (sec) Some shared-ssh installations assume that 'hg serve --stdio' is a safe command to run for minimally trusted users. Unfortunately, the messy implementation of argument parsing here meant that trying to access a repo named '--debugger' would give the user a pdb prompt, thereby sidestepping any hoped-for sandboxing. Serving repositories over HTTP(S) is unaffected. We're not currently hardening any subcommands other than 'serve'. If your service exposes other commands to users with arbitrary repository names, it is imperative that you defend against repository names of '--debugger' and anything starting with '--config'. The read-only mode of hg-ssh stopped working because it provided its hook configuration to "hg serve --stdio" via --config parameter. This is banned for security reasons now. This patch switches it to directly call ui.setconfig(). If your custom hosting infrastructure relies on passing --config to "hg serve --stdio", you'll need to find a different way to get that configuration into Mercurial, either by using ui.setconfig() as hg-ssh does in this patch, or by placing an hgrc file someplace where Mercurial will read it. mitrandir@fb.com provided some extra fixes for the dispatch code and for hg-ssh in places that I overlooked.

File last commit:

r31599:e4aefdb5 default
r32050:77eaf953 4.1.3 stable
Show More
automv.py
100 lines | 3.3 KiB | text/x-python | PythonLexer
# automv.py
#
# Copyright 2013-2016 Facebook, Inc.
#
# This software may be used and distributed according to the terms of the
# GNU General Public License version 2 or any later version.
"""Check for unrecorded moves at commit time (EXPERIMENTAL)
This extension checks at commit/amend time if any of the committed files
comes from an unrecorded mv.
The threshold at which a file is considered a move can be set with the
``automv.similarity`` config option. This option takes a percentage between 0
(disabled) and 100 (files must be identical), the default is 95.
"""
# Using 95 as a default similarity is based on an analysis of the mercurial
# repositories of the cpython, mozilla-central & mercurial repositories, as
# well as 2 very large facebook repositories. At 95 50% of all potential
# missed moves would be caught, as well as correspond with 87% of all
# explicitly marked moves. Together, 80% of moved files are 95% similar or
# more.
#
# See http://markmail.org/thread/5pxnljesvufvom57 for context.
from __future__ import absolute_import
from mercurial.i18n import _
from mercurial import (
commands,
copies,
error,
extensions,
scmutil,
similar
)
def extsetup(ui):
entry = extensions.wrapcommand(
commands.table, 'commit', mvcheck)
entry[1].append(
('', 'no-automv', None,
_('disable automatic file move detection')))
def mvcheck(orig, ui, repo, *pats, **opts):
"""Hook to check for moves at commit time"""
renames = None
disabled = opts.pop('no_automv', False)
if not disabled:
threshold = ui.configint('automv', 'similarity', 95)
if not 0 <= threshold <= 100:
raise error.Abort(_('automv.similarity must be between 0 and 100'))
if threshold > 0:
match = scmutil.match(repo[None], pats, opts)
added, removed = _interestingfiles(repo, match)
renames = _findrenames(repo, match, added, removed,
threshold / 100.0)
with repo.wlock():
if renames is not None:
scmutil._markchanges(repo, (), (), renames)
return orig(ui, repo, *pats, **opts)
def _interestingfiles(repo, matcher):
"""Find what files were added or removed in this commit.
Returns a tuple of two lists: (added, removed). Only files not *already*
marked as moved are included in the added list.
"""
stat = repo.status(match=matcher)
added = stat[1]
removed = stat[2]
copy = copies._forwardcopies(repo['.'], repo[None], matcher)
# remove the copy files for which we already have copy info
added = [f for f in added if f not in copy]
return added, removed
def _findrenames(repo, matcher, added, removed, similarity):
"""Find what files in added are really moved files.
Any file named in removed that is at least similarity% similar to a file
in added is seen as a rename.
"""
renames = {}
if similarity > 0:
for src, dst, score in similar.findrenames(
repo, added, removed, similarity):
if repo.ui.verbose:
repo.ui.status(
_('detected move of %s as %s (%d%% similar)\n') % (
matcher.rel(src), matcher.rel(dst), score * 100))
renames[dst] = src
if renames:
repo.ui.status(_('detected move of %d files\n') % len(renames))
return renames