This is an archive of the discontinued Mercurial Phabricator instance.

Differential D1156

tests: add test demonstrating regression in path audit
ClosedPublic

Authored by mbthomas on Oct 17 2017, 11:14 AM.

Details

Reviewers
ryanmce
Group Reviewers
hg-reviewers
Commits
rHGd6009d1488e8: tests: add test demonstrating regression in path audit
Summary

D785 regressed behavior in path auditing: files can be deleted if they have a
path that conflicts with a filename from a malicious remote or bundle.

This test demonstrates the problem - the file should not have been deleted.

Diff Detail

Repository
rHG Mercurial
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

mbthomas created this revision.Oct 17 2017, 11:14 AM
ryanmce accepted this revision.Oct 17 2017, 5:10 PM
This revision is now accepted and ready to land.Oct 17 2017, 5:10 PM
Closed by commit rHGd6009d1488e8: tests: add test demonstrating regression in path audit (authored by mbthomas). · Explain WhyOct 17 2017, 5:21 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mtests/test-audit-path.t (5 lines)

Diff 2945

tests/test-audit-path.t

abort: * (glob) abort: * (glob)
[255] [255]
#endif #endif
attack ../test attack ../test
$ hg manifest -r3 $ hg manifest -r3
../test ../test
$ mkdir ../test
$ echo data > ../test/file
$ hg update -Cr3 $ hg update -Cr3
abort: path contains illegal component: ../test (glob) abort: path contains illegal component: ../test (glob)
[255] [255]
$ cat ../test/file
cat: ../test/file: No such file or directory
[1]
attack /tmp/test attack /tmp/test
$ hg manifest -r4 $ hg manifest -r4
/tmp/test /tmp/test
$ hg update -Cr4 $ hg update -Cr4
abort: path contains illegal component: /tmp/test (glob) abort: path contains illegal component: /tmp/test (glob)
[255] [255]