mercurial: work around faulty parsing of early command options (#27516)
Use -sVALUE and --long=VALUE instead of "-s VALUE" and "--long VALUE"
respectively.
Contributed by Yuya Nishihara.
git-svn-id: http://svn.redmine.org/redmine/trunk@17062 e93f8b46-1217-0410-a6f0-8f06a7374b81
mercurial: separate command options and positional arguments with "--" (#27516)
We don't have much problems here thanks to hgtarget(path) and CGI.escape(),
which prepends a repository path and encodes "=" character respectively, but
it's better to not rely on the side effect of these functions.
Contributed by Yuya Nishihara.
git-svn-id: http://svn.redmine.org/redmine/trunk@17061 e93f8b46-1217-0410-a6f0-8f06a7374b81
We've got a security report from the Phabricator team, which basically says
--config and --debugger arguments can be injected anywhere to lead to an
arbitrary command execution.
https://secure.phabricator.com/rPa7921a4448093d00defa8bd18f35b8c8f8bf3314
This is a fundamental issue of the argument parsing rules in Mercurial, which
allows extensions to populate their parsing rules and such extensions can be
loaded by "--config extensions.<name>=". There's a chicken and egg problem.
We're working on hardening the parsing rules, but which won't come in by
default as it would be a behavior change.
This patch adds a verification to reject malicious command arguments as a
last ditch. The subsequent patches will fix the problem in more appropriate
way.
Contributed by Yuya Nishihara.
git-svn-id: http://svn.redmine.org/redmine/trunk@17060 e93f8b46-1217-0410-a6f0-8f06a7374b81
scm: mercurial: drop supporting below Mercurial 1.1 (#9465)
On November 1st 2011, Mercurial 2.0 will be released.
On Mercurial 1.1.2, unit lib test fails with following error.
<pre>
Traceback (most recent call last):
File "/WEB-DOWN/hg-repo/hg-crew/hg", line 20, in <module>
mercurial.dispatch.run()
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/dispatch.py", line 20, in run
sys.exit(dispatch(sys.argv[1:]))
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/dispatch.py", line 29, in dispatch
return _runcatch(u, args)
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/dispatch.py", line 45, in _runcatch
return _dispatch(ui, args)
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/dispatch.py", line 367, in _dispatch
ret = _runcommand(ui, options, cmd, d)
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/dispatch.py", line 416, in _runcommand
return checkargs()
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/dispatch.py", line 376, in checkargs
return cmdfunc()
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/dispatch.py", line 361, in <lambda>
d = lambda: util.checksignature(func)(ui, *args, **cmdoptions)
File "/WEB-DOWN/hg-repo/hg-crew/mercurial/util.py", line 715, in check
return func(*args, **kwargs)
File "/REDMINE-1/hg-workdir/redmine-bb-all/lib/redmine/scm/adapters/mercurial/redminehelper.py", line 149, in rhlog
if hg.util.version() >= '1.6':
AttributeError: 'module' object has no attribute 'version'
1) Error:
test_nodes_in_branch(MercurialAdapterTest):
Redmine::Scm::Adapters::MercurialAdapter::HgCommandAborted: hg exited with non-zero status: 1
lib/redmine/scm/adapters/mercurial_adapter.rb:306:in `hg'
lib/redmine/scm/adapters/mercurial_adapter.rb:234:in `nodes_in_branch'
test/unit/lib/redmine/scm/adapters/mercurial_adapter_test.rb:311:in `test_nodes_in_branch'
test/unit/lib/redmine/scm/adapters/mercurial_adapter_test.rb:304:in `each'
test/unit/lib/redmine/scm/adapters/mercurial_adapter_test.rb:304:in `test_nodes_in_branch'
</pre>
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@7650 e93f8b46-1217-0410-a6f0-8f06a7374b81
Go MAEDA
Toshi MARUYAMA
Jean-Philippe Lang