This is an archive of the discontinued Mercurial Phabricator instance.

Differential D2718

wireproto: declare permissions requirements in @wireprotocommand (API)
ClosedPublic

Authored by indygreg on Mar 7 2018, 7:24 PM.

Details

Reviewers
durin42
Group Reviewers
hg-reviewers
Commits
rHG0b18604db95e: wireproto: declare permissions requirements in @wireprotocommand (API)
Summary

With the security patches from 4.5.2 merged into default, we now
have a per-command attribute defining what permissions are needed
to run that command. We now have a richer @wireprotocommand that
can be extended to record additional command metadata. So we
port the permissions mechanism to be based on @wireprotocommand.

.. api::

hgweb_mod.perms and wireproto.permissions have been removed. Wire
protocol commands should declare their required permissions in the
@wireprotocommand decorator.

Diff Detail

Repository
rHG Mercurial
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

indygreg created this revision.Mar 7 2018, 7:24 PM
durin42 accepted this revision.Mar 9 2018, 1:51 PM
This revision is now accepted and ready to land.Mar 9 2018, 1:51 PM
Closed by commit rHG0b18604db95e: wireproto: declare permissions requirements in @wireprotocommand (API) (authored by indygreg). · Explain WhyMar 9 2018, 2:29 PM
This revision was automatically updated to reflect the committed changes.
yuja added a subscriber: yuja.Mar 10 2018, 3:38 AM
yuja added inline comments.
mercurial/wireproto.py
711

Perhaps ProgrammingError is preferred here because it shouldn't
be a user-facing error.

indygreg added inline comments.Mar 10 2018, 11:26 AM
mercurial/wireproto.py
711

I agree. I'll send a follow-up (unless we want to amend hg-committed).

Revision Contents
Changeset List

Diff 6772

hgext/largefiles/uisetup.py

overrides.postcommitstatus) overrides.postcommitstatus)
extensions.wrapfunction(scmutil, 'marktouched', extensions.wrapfunction(scmutil, 'marktouched',
overrides.scmutilmarktouched) overrides.scmutilmarktouched)
extensions.wrapfunction(url, 'open', extensions.wrapfunction(url, 'open',
overrides.openlargefile) overrides.openlargefile)
# create the new wireproto commands ... # create the new wireproto commands ...
wireproto.wireprotocommand('putlfile', 'sha')(proto.putlfile) wireproto.wireprotocommand('putlfile', 'sha', permission='push')(
wireproto.wireprotocommand('getlfile', 'sha')(proto.getlfile) proto.putlfile)
wireproto.wireprotocommand('statlfile', 'sha')(proto.statlfile) wireproto.wireprotocommand('getlfile', 'sha', permission='pull')(
wireproto.wireprotocommand('lheads', '')(wireproto.heads) proto.getlfile)
wireproto.wireprotocommand('statlfile', 'sha', permission='pull')(
proto.statlfile)
wireproto.wireprotocommand('lheads', '', permission='pull')(
wireproto.heads)
# ... and wrap some existing ones # ... and wrap some existing ones
wireproto.commands['heads'].func = proto.heads wireproto.commands['heads'].func = proto.heads
# make putlfile behave the same as push and {get,stat}lfile behave
# the same as pull w.r.t. permissions checks
wireproto.permissions['putlfile'] = 'push'
wireproto.permissions['getlfile'] = 'pull'
wireproto.permissions['statlfile'] = 'pull'
wireproto.permissions['lheads'] = 'pull'
extensions.wrapfunction(webcommands, 'decodepath', overrides.decodepath) extensions.wrapfunction(webcommands, 'decodepath', overrides.decodepath)
extensions.wrapfunction(wireproto, '_capabilities', proto._capabilities) extensions.wrapfunction(wireproto, '_capabilities', proto._capabilities)
# can't do this in reposetup because it needs to have happened before # can't do this in reposetup because it needs to have happened before
# wirerepo.__init__ is called # wirerepo.__init__ is called
proto.ssholdcallstream = sshpeer.sshv1peer._callstream proto.ssholdcallstream = sshpeer.sshv1peer._callstream
proto.httpoldcallstream = httppeer.httppeer._callstream proto.httpoldcallstream = httppeer.httppeer._callstream

mercurial/hgweb/hgweb_mod.py

hook, hook,
profiling, profiling,
pycompat, pycompat,
repoview, repoview,
templatefilters, templatefilters,
templater, templater,
ui as uimod, ui as uimod,
util, util,
wireproto,
wireprotoserver, wireprotoserver,
) )
from . import ( from . import (
webcommands, webcommands,
webutil, webutil,
wsgicgi, wsgicgi,
) )
# Aliased for API compatibility.
perms = wireproto.permissions
archivespecs = util.sortdict(( archivespecs = util.sortdict((
('zip', ('application/zip', 'zip', '.zip', None)), ('zip', ('application/zip', 'zip', '.zip', None)),
('gz', ('application/x-gzip', 'tgz', '.tar.gz', None)), ('gz', ('application/x-gzip', 'tgz', '.tar.gz', None)),
('bz2', ('application/x-bzip2', 'tbz2', '.tar.bz2', None)), ('bz2', ('application/x-bzip2', 'tbz2', '.tar.bz2', None)),
)) ))
def getstyle(req, configfn, templatepath): def getstyle(req, configfn, templatepath):
fromreq = req.form.get('style', [None])[0] fromreq = req.form.get('style', [None])[0]

mercurial/wireproto.py

'compression engines') % config, 'compression engines') % config,
hint=_('usable compression engines: %s') % hint=_('usable compression engines: %s') %
', '.sorted(validnames)) ', '.sorted(validnames))
return compengines return compengines
class commandentry(object): class commandentry(object):
"""Represents a declared wire protocol command.""" """Represents a declared wire protocol command."""
def __init__(self, func, args='', transports=None): def __init__(self, func, args='', transports=None,
permission='push'):
self.func = func self.func = func
self.args = args self.args = args
self.transports = transports or set() self.transports = transports or set()
self.permission = permission
def _merge(self, func, args): def _merge(self, func, args):
"""Merge this instance with an incoming 2-tuple. """Merge this instance with an incoming 2-tuple.
This is called when a caller using the old 2-tuple API attempts This is called when a caller using the old 2-tuple API attempts
to replace an instance. The incoming values are merged with to replace an instance. The incoming values are merged with
data not captured by the 2-tuple and a new instance containing data not captured by the 2-tuple and a new instance containing
the union of the two objects is returned. the union of the two objects is returned.
""" """
return commandentry(func, args=args, transports=set(self.transports)) return commandentry(func, args=args, transports=set(self.transports),
permission=self.permission)
# Old code treats instances as 2-tuples. So expose that interface. # Old code treats instances as 2-tuples. So expose that interface.
def __iter__(self): def __iter__(self):
yield self.func yield self.func
yield self.args yield self.args
def __getitem__(self, i): def __getitem__(self, i):
if i == 0: if i == 0:
# e.g. ``wireproto.commands[x] = (newfn, args)``. Because callers # e.g. ``wireproto.commands[x] = (newfn, args)``. Because callers
# doing this aren't aware of the new API that uses objects to store # doing this aren't aware of the new API that uses objects to store
# command entries, we automatically merge old state with new. # command entries, we automatically merge old state with new.
if k in self: if k in self:
v = self[k]._merge(v[0], v[1]) v = self[k]._merge(v[0], v[1])
else: else:
# Use default values from @wireprotocommand. # Use default values from @wireprotocommand.
v = commandentry(v[0], args=v[1], v = commandentry(v[0], args=v[1],
transports=set(wireprototypes.TRANSPORTS)) transports=set(wireprototypes.TRANSPORTS),
permission='push')
else: else:
raise ValueError('command entries must be commandentry instances ' raise ValueError('command entries must be commandentry instances '
'or 2-tuples') 'or 2-tuples')
return super(commanddict, self).__setitem__(k, v) return super(commanddict, self).__setitem__(k, v)
def commandavailable(self, command, proto): def commandavailable(self, command, proto):
"""Determine if a command is available for the requested protocol.""" """Determine if a command is available for the requested protocol."""
# Constants specifying which transports a wire protocol command should be # Constants specifying which transports a wire protocol command should be
# available on. For use with @wireprotocommand. # available on. For use with @wireprotocommand.
POLICY_ALL = 'all' POLICY_ALL = 'all'
POLICY_V1_ONLY = 'v1-only' POLICY_V1_ONLY = 'v1-only'
POLICY_V2_ONLY = 'v2-only' POLICY_V2_ONLY = 'v2-only'
commands = commanddict() commands = commanddict()
# Maps wire protocol name to operation type. This is used for permissions def wireprotocommand(name, args='', transportpolicy=POLICY_ALL,
# checking. All defined @wireiprotocommand should have an entry in this permission='push'):
# dict.
permissions = {}
def wireprotocommand(name, args='', transportpolicy=POLICY_ALL):
"""Decorator to declare a wire protocol command. """Decorator to declare a wire protocol command.
``name`` is the name of the wire protocol command being provided. ``name`` is the name of the wire protocol command being provided.
``args`` is a space-delimited list of named arguments that the command ``args`` is a space-delimited list of named arguments that the command
accepts. ``*`` is a special value that says to accept all arguments. accepts. ``*`` is a special value that says to accept all arguments.
``transportpolicy`` is a POLICY_* constant denoting which transports ``transportpolicy`` is a POLICY_* constant denoting which transports
this wire protocol command should be exposed to. By default, commands this wire protocol command should be exposed to. By default, commands
are exposed to all wire protocol transports. are exposed to all wire protocol transports.
``permission`` defines the permission type needed to run this command.
Can be ``push`` or ``pull``. These roughly map to read-write and read-only,
respectively. Default is to assume command requires ``push`` permissions
because otherwise commands not declaring their permissions could modify
a repository that is supposed to be read-only.
""" """
if transportpolicy == POLICY_ALL: if transportpolicy == POLICY_ALL:
transports = set(wireprototypes.TRANSPORTS) transports = set(wireprototypes.TRANSPORTS)
elif transportpolicy == POLICY_V1_ONLY: elif transportpolicy == POLICY_V1_ONLY:
transports = {k for k, v in wireprototypes.TRANSPORTS.items() transports = {k for k, v in wireprototypes.TRANSPORTS.items()
if v['version'] == 1} if v['version'] == 1}
elif transportpolicy == POLICY_V2_ONLY: elif transportpolicy == POLICY_V2_ONLY:
transports = {k for k, v in wireprototypes.TRANSPORTS.items() transports = {k for k, v in wireprototypes.TRANSPORTS.items()
if v['version'] == 2} if v['version'] == 2}
else: else:
raise error.Abort(_('invalid transport policy value: %s') % raise error.Abort(_('invalid transport policy value: %s') %
transportpolicy) transportpolicy)
if permission not in ('push', 'pull'):
raise error.Abort(_('invalid wire protocol permission; got %s; '
yujaUnsubmitted
Not Done

Perhaps ProgrammingError is preferred here because it shouldn't
be a user-facing error.

yuja: Perhaps ProgrammingError is preferred here because it shouldn't be a user-facing error.
indygregAuthorUnsubmitted
Not Done

I agree. I'll send a follow-up (unless we want to amend hg-committed).

indygreg: I agree. I'll send a follow-up (unless we want to amend hg-committed).
'expected "push" or "pull"') % permission)
def register(func): def register(func):
commands[name] = commandentry(func, args=args, transports=transports) commands[name] = commandentry(func, args=args, transports=transports,
permission=permission)
return func return func
return register return register
# TODO define a more appropriate permissions type to use for this. # TODO define a more appropriate permissions type to use for this.
permissions['batch'] = 'pull' @wireprotocommand('batch', 'cmds *', permission='pull')
@wireprotocommand('batch', 'cmds *')
def batch(repo, proto, cmds, others): def batch(repo, proto, cmds, others):
repo = repo.filtered("served") repo = repo.filtered("served")
res = [] res = []
for pair in cmds.split(';'): for pair in cmds.split(';'):
op, args = pair.split(' ', 1) op, args = pair.split(' ', 1)
vals = {} vals = {}
for a in args.split(','): for a in args.split(','):
if a: if a:
n, v = a.split('=') n, v = a.split('=')
vals[unescapearg(n)] = unescapearg(v) vals[unescapearg(n)] = unescapearg(v)
func, spec = commands[op] func, spec = commands[op]
# If the protocol supports permissions checking, perform that # If the protocol supports permissions checking, perform that
# checking on each batched command. # checking on each batched command.
# TODO formalize permission checking as part of protocol interface. # TODO formalize permission checking as part of protocol interface.
if util.safehasattr(proto, 'checkperm'): if util.safehasattr(proto, 'checkperm'):
# Assume commands with no defined permissions are writes / for perm = commands[op].permission
# pushes. This is the safest from a security perspective because assert perm in ('push', 'pull')
# it doesn't allow commands with undefined semantics from proto.checkperm(perm)
# bypassing permissions checks.
proto.checkperm(permissions.get(op, 'push'))
if spec: if spec:
keys = spec.split() keys = spec.split()
data = {} data = {}
for k in keys: for k in keys:
if k == '*': if k == '*':
star = {} star = {}
for key in vals.keys(): for key in vals.keys():
# raw bytes (for backwards compatibility). # raw bytes (for backwards compatibility).
assert isinstance(result, (bytesresponse, bytes)) assert isinstance(result, (bytesresponse, bytes))
if isinstance(result, bytesresponse): if isinstance(result, bytesresponse):
result = result.data result = result.data
res.append(escapearg(result)) res.append(escapearg(result))
return bytesresponse(';'.join(res)) return bytesresponse(';'.join(res))
permissions['between'] = 'pull' @wireprotocommand('between', 'pairs', transportpolicy=POLICY_V1_ONLY,
@wireprotocommand('between', 'pairs', transportpolicy=POLICY_V1_ONLY) permission='pull')
def between(repo, proto, pairs): def between(repo, proto, pairs):
pairs = [decodelist(p, '-') for p in pairs.split(" ")] pairs = [decodelist(p, '-') for p in pairs.split(" ")]
r = [] r = []
for b in repo.between(pairs): for b in repo.between(pairs):
r.append(encodelist(b) + "\n") r.append(encodelist(b) + "\n")
return bytesresponse(''.join(r)) return bytesresponse(''.join(r))
permissions['branchmap'] = 'pull' @wireprotocommand('branchmap', permission='pull')
@wireprotocommand('branchmap')
def branchmap(repo, proto): def branchmap(repo, proto):
branchmap = repo.branchmap() branchmap = repo.branchmap()
heads = [] heads = []
for branch, nodes in branchmap.iteritems(): for branch, nodes in branchmap.iteritems():
branchname = urlreq.quote(encoding.fromlocal(branch)) branchname = urlreq.quote(encoding.fromlocal(branch))
branchnodes = encodelist(nodes) branchnodes = encodelist(nodes)
heads.append('%s %s' % (branchname, branchnodes)) heads.append('%s %s' % (branchname, branchnodes))
return bytesresponse('\n'.join(heads)) return bytesresponse('\n'.join(heads))
permissions['branches'] = 'pull' @wireprotocommand('branches', 'nodes', transportpolicy=POLICY_V1_ONLY,
@wireprotocommand('branches', 'nodes', transportpolicy=POLICY_V1_ONLY) permission='pull')
def branches(repo, proto, nodes): def branches(repo, proto, nodes):
nodes = decodelist(nodes) nodes = decodelist(nodes)
r = [] r = []
for b in repo.branches(nodes): for b in repo.branches(nodes):
r.append(encodelist(b) + "\n") r.append(encodelist(b) + "\n")
return bytesresponse(''.join(r)) return bytesresponse(''.join(r))
permissions['clonebundles'] = 'pull' @wireprotocommand('clonebundles', '', permission='pull')
@wireprotocommand('clonebundles', '')
def clonebundles(repo, proto): def clonebundles(repo, proto):
"""Server command for returning info for available bundles to seed clones. """Server command for returning info for available bundles to seed clones.
Clients will parse this response and determine what bundle to fetch. Clients will parse this response and determine what bundle to fetch.
Extensions may wrap this command to filter or dynamically emit data Extensions may wrap this command to filter or dynamically emit data
depending on the request. e.g. you could advertise URLs for the closest depending on the request. e.g. you could advertise URLs for the closest
data center given the client's IP address. data center given the client's IP address.
capsblob = bundle2.encodecaps(bundle2.getrepocaps(repo, role='server')) capsblob = bundle2.encodecaps(bundle2.getrepocaps(repo, role='server'))
caps.append('bundle2=' + urlreq.quote(capsblob)) caps.append('bundle2=' + urlreq.quote(capsblob))
caps.append('unbundle=%s' % ','.join(bundle2.bundlepriority)) caps.append('unbundle=%s' % ','.join(bundle2.bundlepriority))
return proto.addcapabilities(repo, caps) return proto.addcapabilities(repo, caps)
# If you are writing an extension and consider wrapping this function. Wrap # If you are writing an extension and consider wrapping this function. Wrap
# `_capabilities` instead. # `_capabilities` instead.
permissions['capabilities'] = 'pull' @wireprotocommand('capabilities', permission='pull')
@wireprotocommand('capabilities')
def capabilities(repo, proto): def capabilities(repo, proto):
return bytesresponse(' '.join(_capabilities(repo, proto))) return bytesresponse(' '.join(_capabilities(repo, proto)))
permissions['changegroup'] = 'pull' @wireprotocommand('changegroup', 'roots', transportpolicy=POLICY_V1_ONLY,
@wireprotocommand('changegroup', 'roots', transportpolicy=POLICY_V1_ONLY) permission='pull')
def changegroup(repo, proto, roots): def changegroup(repo, proto, roots):
nodes = decodelist(roots) nodes = decodelist(roots)
outgoing = discovery.outgoing(repo, missingroots=nodes, outgoing = discovery.outgoing(repo, missingroots=nodes,
missingheads=repo.heads()) missingheads=repo.heads())
cg = changegroupmod.makechangegroup(repo, outgoing, '01', 'serve') cg = changegroupmod.makechangegroup(repo, outgoing, '01', 'serve')
gen = iter(lambda: cg.read(32768), '') gen = iter(lambda: cg.read(32768), '')
return streamres(gen=gen) return streamres(gen=gen)
permissions['changegroupsubset'] = 'pull'
@wireprotocommand('changegroupsubset', 'bases heads', @wireprotocommand('changegroupsubset', 'bases heads',
transportpolicy=POLICY_V1_ONLY) transportpolicy=POLICY_V1_ONLY,
permission='pull')
def changegroupsubset(repo, proto, bases, heads): def changegroupsubset(repo, proto, bases, heads):
bases = decodelist(bases) bases = decodelist(bases)
heads = decodelist(heads) heads = decodelist(heads)
outgoing = discovery.outgoing(repo, missingroots=bases, outgoing = discovery.outgoing(repo, missingroots=bases,
missingheads=heads) missingheads=heads)
cg = changegroupmod.makechangegroup(repo, outgoing, '01', 'serve') cg = changegroupmod.makechangegroup(repo, outgoing, '01', 'serve')
gen = iter(lambda: cg.read(32768), '') gen = iter(lambda: cg.read(32768), '')
return streamres(gen=gen) return streamres(gen=gen)
permissions['debugwireargs'] = 'pull' @wireprotocommand('debugwireargs', 'one two *',
@wireprotocommand('debugwireargs', 'one two *') permission='pull')
def debugwireargs(repo, proto, one, two, others): def debugwireargs(repo, proto, one, two, others):
# only accept optional args from the known set # only accept optional args from the known set
opts = options('debugwireargs', ['three', 'four'], others) opts = options('debugwireargs', ['three', 'four'], others)
return bytesresponse(repo.debugwireargs(one, two, return bytesresponse(repo.debugwireargs(one, two,
**pycompat.strkwargs(opts))) **pycompat.strkwargs(opts)))
permissions['getbundle'] = 'pull' @wireprotocommand('getbundle', '*', permission='pull')
@wireprotocommand('getbundle', '*')
def getbundle(repo, proto, others): def getbundle(repo, proto, others):
opts = options('getbundle', gboptsmap.keys(), others) opts = options('getbundle', gboptsmap.keys(), others)
for k, v in opts.iteritems(): for k, v in opts.iteritems():
keytype = gboptsmap[k] keytype = gboptsmap[k]
if keytype == 'nodes': if keytype == 'nodes':
opts[k] = decodelist(v) opts[k] = decodelist(v)
elif keytype == 'csv': elif keytype == 'csv':
opts[k] = list(v.split(',')) opts[k] = list(v.split(','))
advargs.append(('hint', exc.hint)) advargs.append(('hint', exc.hint))
bundler.addpart(bundle2.bundlepart('error:abort', bundler.addpart(bundle2.bundlepart('error:abort',
manargs, advargs)) manargs, advargs))
chunks = bundler.getchunks() chunks = bundler.getchunks()
prefercompressed = False prefercompressed = False
return streamres(gen=chunks, prefer_uncompressed=not prefercompressed) return streamres(gen=chunks, prefer_uncompressed=not prefercompressed)
permissions['heads'] = 'pull' @wireprotocommand('heads', permission='pull')
@wireprotocommand('heads')
def heads(repo, proto): def heads(repo, proto):
h = repo.heads() h = repo.heads()
return bytesresponse(encodelist(h) + '\n') return bytesresponse(encodelist(h) + '\n')
permissions['hello'] = 'pull' @wireprotocommand('hello', permission='pull')
@wireprotocommand('hello')
def hello(repo, proto): def hello(repo, proto):
"""Called as part of SSH handshake to obtain server info. """Called as part of SSH handshake to obtain server info.
Returns a list of lines describing interesting things about the Returns a list of lines describing interesting things about the
server, in an RFC822-like format. server, in an RFC822-like format.
Currently, the only one defined is ``capabilities``, which consists of a Currently, the only one defined is ``capabilities``, which consists of a
line of space separated tokens describing server abilities: line of space separated tokens describing server abilities:
capabilities: <token0> <token1> <token2> capabilities: <token0> <token1> <token2>
""" """
caps = capabilities(repo, proto).data caps = capabilities(repo, proto).data
return bytesresponse('capabilities: %s\n' % caps) return bytesresponse('capabilities: %s\n' % caps)
permissions['listkeys'] = 'pull' @wireprotocommand('listkeys', 'namespace', permission='pull')
@wireprotocommand('listkeys', 'namespace')
def listkeys(repo, proto, namespace): def listkeys(repo, proto, namespace):
d = sorted(repo.listkeys(encoding.tolocal(namespace)).items()) d = sorted(repo.listkeys(encoding.tolocal(namespace)).items())
return bytesresponse(pushkeymod.encodekeys(d)) return bytesresponse(pushkeymod.encodekeys(d))
permissions['lookup'] = 'pull' @wireprotocommand('lookup', 'key', permission='pull')
@wireprotocommand('lookup', 'key')
def lookup(repo, proto, key): def lookup(repo, proto, key):
try: try:
k = encoding.tolocal(key) k = encoding.tolocal(key)
c = repo[k] c = repo[k]
r = c.hex() r = c.hex()
success = 1 success = 1
except Exception as inst: except Exception as inst:
r = util.forcebytestr(inst) r = util.forcebytestr(inst)
success = 0 success = 0
return bytesresponse('%d %s\n' % (success, r)) return bytesresponse('%d %s\n' % (success, r))
permissions['known'] = 'pull' @wireprotocommand('known', 'nodes *', permission='pull')
@wireprotocommand('known', 'nodes *')
def known(repo, proto, nodes, others): def known(repo, proto, nodes, others):
v = ''.join(b and '1' or '0' for b in repo.known(decodelist(nodes))) v = ''.join(b and '1' or '0' for b in repo.known(decodelist(nodes)))
return bytesresponse(v) return bytesresponse(v)
permissions['pushkey'] = 'push' @wireprotocommand('pushkey', 'namespace key old new', permission='push')
@wireprotocommand('pushkey', 'namespace key old new')
def pushkey(repo, proto, namespace, key, old, new): def pushkey(repo, proto, namespace, key, old, new):
# compatibility with pre-1.8 clients which were accidentally # compatibility with pre-1.8 clients which were accidentally
# sending raw binary nodes rather than utf-8-encoded hex # sending raw binary nodes rather than utf-8-encoded hex
if len(new) == 20 and util.escapestr(new) != new: if len(new) == 20 and util.escapestr(new) != new:
# looks like it could be a binary node # looks like it could be a binary node
try: try:
new.decode('utf-8') new.decode('utf-8')
new = encoding.tolocal(new) # but cleanly decodes as UTF-8 new = encoding.tolocal(new) # but cleanly decodes as UTF-8
except UnicodeDecodeError: except UnicodeDecodeError:
pass # binary, leave unmodified pass # binary, leave unmodified
else: else:
new = encoding.tolocal(new) # normal path new = encoding.tolocal(new) # normal path
with proto.mayberedirectstdio() as output: with proto.mayberedirectstdio() as output:
r = repo.pushkey(encoding.tolocal(namespace), encoding.tolocal(key), r = repo.pushkey(encoding.tolocal(namespace), encoding.tolocal(key),
encoding.tolocal(old), new) or False encoding.tolocal(old), new) or False
output = output.getvalue() if output else '' output = output.getvalue() if output else ''
return bytesresponse('%d\n%s' % (int(r), output)) return bytesresponse('%d\n%s' % (int(r), output))
permissions['stream_out'] = 'pull' @wireprotocommand('stream_out', permission='pull')
@wireprotocommand('stream_out')
def stream(repo, proto): def stream(repo, proto):
'''If the server supports streaming clone, it advertises the "stream" '''If the server supports streaming clone, it advertises the "stream"
capability with a value representing the version and flags of the repo capability with a value representing the version and flags of the repo
it is serving. Client checks to see if it understands the format. it is serving. Client checks to see if it understands the format.
''' '''
return streamres_legacy(streamclone.generatev1wireproto(repo)) return streamres_legacy(streamclone.generatev1wireproto(repo))
permissions['unbundle'] = 'push' @wireprotocommand('unbundle', 'heads', permission='push')
@wireprotocommand('unbundle', 'heads')
def unbundle(repo, proto, heads): def unbundle(repo, proto, heads):
their_heads = decodelist(heads) their_heads = decodelist(heads)
with proto.mayberedirectstdio() as output: with proto.mayberedirectstdio() as output:
try: try:
exchange.check_heads(repo, their_heads, 'preparing changes') exchange.check_heads(repo, their_heads, 'preparing changes')
# write bundle data to temporary file because it can be big # write bundle data to temporary file because it can be big

mercurial/wireprotoserver.py

yield chunk yield chunk
if not wireproto.commands.commandavailable(cmd, proto): if not wireproto.commands.commandavailable(cmd, proto):
req.respond(HTTP_OK, HGERRTYPE, req.respond(HTTP_OK, HGERRTYPE,
body=_('requested wire protocol command is not available ' body=_('requested wire protocol command is not available '
'over HTTP')) 'over HTTP'))
return [] return []
# Assume commands with no defined permissions are writes / checkperm(wireproto.commands[cmd].permission)
# for pushes. This is the safest from a security perspective
# because it doesn't allow commands with undefined semantics
# from bypassing permissions checks.
checkperm(wireproto.permissions.get(cmd, 'push'))
rsp = wireproto.dispatch(repo, proto, cmd) rsp = wireproto.dispatch(repo, proto, cmd)
if isinstance(rsp, bytes): if isinstance(rsp, bytes):
req.respond(HTTP_OK, HGTYPE, body=rsp) req.respond(HTTP_OK, HGTYPE, body=rsp)
return [] return []
elif isinstance(rsp, wireprototypes.bytesresponse): elif isinstance(rsp, wireprototypes.bytesresponse):
req.respond(HTTP_OK, HGTYPE, body=rsp.data) req.respond(HTTP_OK, HGTYPE, body=rsp.data)

tests/test-http-permissions.t

> hgweb_mod.hgweb = testenvhgweb > hgweb_mod.hgweb = testenvhgweb
> >
> @wireproto.wireprotocommand('customreadnoperm') > @wireproto.wireprotocommand('customreadnoperm')
> def customread(repo, proto): > def customread(repo, proto):
> return b'read-only command no defined permissions\n' > return b'read-only command no defined permissions\n'
> @wireproto.wireprotocommand('customwritenoperm') > @wireproto.wireprotocommand('customwritenoperm')
> def customwritenoperm(repo, proto): > def customwritenoperm(repo, proto):
> return b'write command no defined permissions\n' > return b'write command no defined permissions\n'
> wireproto.permissions['customreadwithperm'] = 'pull' > @wireproto.wireprotocommand('customreadwithperm', permission='pull')
> @wireproto.wireprotocommand('customreadwithperm')
> def customreadwithperm(repo, proto): > def customreadwithperm(repo, proto):
> return b'read-only command w/ defined permissions\n' > return b'read-only command w/ defined permissions\n'
> wireproto.permissions['customwritewithperm'] = 'push' > @wireproto.wireprotocommand('customwritewithperm', permission='push')
> @wireproto.wireprotocommand('customwritewithperm')
> def customwritewithperm(repo, proto): > def customwritewithperm(repo, proto):
> return b'write command w/ defined permissions\n' > return b'write command w/ defined permissions\n'
> EOF > EOF
$ cat >> $HGRCPATH << EOF $ cat >> $HGRCPATH << EOF
> [extensions] > [extensions]
> fakeremoteuser = $TESTTMP/fakeremoteuser.py > fakeremoteuser = $TESTTMP/fakeremoteuser.py
> strip = > strip =