##// END OF EJS Templates
convert: test for shell injection in git calls (SEC)...
convert: test for shell injection in git calls (SEC) CVE-2016-3069 (5/5) Before recent refactoring we were not escaping calls to git at all which made such injections possible. Let's have a test for that to avoid this problem in the future. Reported by Blake Burkhart.

File last commit:

r16948:a0cbbf78 default
r28663:ae279d4a 3.7.3 stable
Show More
test-convert-authormap.t
58 lines | 1.2 KiB | text/troff | Tads3Lexer
/ tests / test-convert-authormap.t
$ cat >> $HGRCPATH <<EOF
> [extensions]
> convert=
> EOF
Prepare orig repo
$ hg init orig
$ cd orig
$ echo foo > foo
$ HGUSER='user name' hg ci -qAm 'foo'
$ cd ..
Explicit --authors
$ cat > authormap.txt <<EOF
> user name = Long User Name
>
> # comment
> this line is ignored
> EOF
$ hg convert --authors authormap.txt orig new
initializing destination new repository
ignoring bad line in author map file authormap.txt: this line is ignored
scanning source...
sorting...
converting...
0 foo
writing author map file $TESTTMP/new/.hg/authormap (glob)
$ cat new/.hg/authormap
user name=Long User Name
$ hg -Rnew log
changeset: 0:d89716e88087
tag: tip
user: Long User Name
date: Thu Jan 01 00:00:00 1970 +0000
summary: foo
$ rm -rf new
Implicit .hg/authormap
$ hg init new
$ mv authormap.txt new/.hg/authormap
$ hg convert orig new
ignoring bad line in author map file $TESTTMP/new/.hg/authormap: this line is ignored (glob)
scanning source...
sorting...
converting...
0 foo
$ hg -Rnew log
changeset: 0:d89716e88087
tag: tip
user: Long User Name
date: Thu Jan 01 00:00:00 1970 +0000
summary: foo