We've got a security report from the Phabricator team, which basically says
--config and --debugger arguments can be injected anywhere to lead to an
arbitrary command execution.
https://secure.phabricator.com/rPa7921a4448093d00defa8bd18f35b8c8f8bf3314
This is a fundamental issue of the argument parsing rules in Mercurial, which
allows extensions to populate their parsing rules and such extensions can be
loaded by "--config extensions.<name>=". There's a chicken and egg problem.
We're working on hardening the parsing rules, but which won't come in by
default as it would be a behavior change.
This patch adds a verification to reject malicious command arguments as a
last ditch. The subsequent patches will fix the problem in more appropriate
way.
Contributed by Yuya Nishihara.
git-svn-id: http://svn.redmine.org/redmine/trunk@17060 e93f8b46-1217-0410-a6f0-8f06a7374b81
On November 1st 2011, Mercurial 2.0 will be released.
On Mercurial 1.1.2, unit lib test fails with following error.
<pre>
Traceback (most recent call last):
File "/WEB-DOWN/hg-repo/hg-crew/hg", line 20, in <module>
mercurial.dispatch.run()
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/dispatch.py", line 20, in run
sys.exit(dispatch(sys.argv[1:]))
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/dispatch.py", line 29, in dispatch
return _runcatch(u, args)
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/dispatch.py", line 45, in _runcatch
return _dispatch(ui, args)
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/dispatch.py", line 367, in _dispatch
ret = _runcommand(ui, options, cmd, d)
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/dispatch.py", line 416, in _runcommand
return checkargs()
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/dispatch.py", line 376, in checkargs
return cmdfunc()
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/dispatch.py", line 361, in <lambda>
d = lambda: util.checksignature(func)(ui, *args, **cmdoptions)
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/util.py", line 715, in check
return func(*args, **kwargs)
File "/REDMINE-1/hg-workdir/redmine-bb-all/lib/redmine/scm/adapters/mercurial/redminehelper.py", line 149, in rhlog
if hg.util.version() >= '1.6':
AttributeError: 'module' object has no attribute 'version'
1) Error:
test_nodes_in_branch(MercurialAdapterTest):
Redmine::Scm::Adapters::MercurialAdapter::HgCommandAborted: hg exited with non-zero status: 1
lib/redmine/scm/adapters/mercurial_adapter.rb:306:in `hg'
lib/redmine/scm/adapters/mercurial_adapter.rb:234:in `nodes_in_branch'
test/unit/lib/redmine/scm/adapters/mercurial_adapter_test.rb:311:in `test_nodes_in_branch'
test/unit/lib/redmine/scm/adapters/mercurial_adapter_test.rb:304:in `each'
test/unit/lib/redmine/scm/adapters/mercurial_adapter_test.rb:304:in `test_nodes_in_branch'
</pre>
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@7650 e93f8b46-1217-0410-a6f0-8f06a7374b81
Tests of non ASCII nor alphabetic nor numeric *named branch* fails on below Mercurial 1.5.
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@7642 e93f8b46-1217-0410-a6f0-8f06a7374b81
Mercurial (and also Git) treats file names as byte string.
This mercurial test repository contains Latin-1 encoding path.
Be careful on non Latin-1(CP1252) Windows.
If your Windows is not Latin-1 Windows,
in order to checkout(update) Latin-1 path,
You need to use cygwin 1.7 and set LANG=en_US.ISO-8859-1.
Please refer.
http://mercurial.selenic.com/wiki/EncodingStrategy?action=recall&rev=6
Redmine mercurial adapter do not need to checkout(update) repository.
Mercurial does not have "bare" repository such as Git.
You can use "hg update null" for equivalent "bare" repository.
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@4996 e93f8b46-1217-0410-a6f0-8f06a7374b81
