This is an archive of the discontinued Mercurial Phabricator instance.

Differential D2936

hgweb: don't responsd to api requests unless feature is enabled
ClosedPublic

Authored by indygreg on Mar 23 2018, 2:20 PM.

Details

Reviewers
yuja
Group Reviewers
hg-reviewers
Commits
rHGdb114320df7e: hgweb: don't responsd to api requests unless feature is enabled
Summary

Per discussion at https://phab.mercurial-scm.org/D2834, new URLs
in hgweb can conflict with subrepos and virtual repos. This may prevent
access to repos in certain paths or having certain names.

Until we have a workaround for this, let's not serve requests for
"api/" URLs unless the feature is enabled.

Diff Detail

Repository
rHG Mercurial
Lint
Lint Skipped
Unit
Unit Tests Skipped

Event Timeline

indygreg created this revision.Mar 23 2018, 2:20 PM
yuja accepted this revision.Mar 23 2018, 10:57 PM
This revision is now accepted and ready to land.Mar 23 2018, 10:57 PM
yuja added a comment.Mar 23 2018, 10:57 PM

Queued, many thanks.

Closed by commit rHGdb114320df7e: hgweb: don't responsd to api requests unless feature is enabled (authored by indygreg). · Explain WhyMar 23 2018, 11:07 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mmercurial/hgweb/hgweb_mod.py (7 lines)
Mtests/test-http-api.t (162 lines)

Diff 7256

mercurial/hgweb/hgweb_mod.py

rctx.repo.ui.environ = req.rawenv rctx.repo.ui.environ = req.rawenv
if rctx.csp: if rctx.csp:
# hgwebdir may have added CSP header. Since we generate our own, # hgwebdir may have added CSP header. Since we generate our own,
# replace it. # replace it.
res.headers['Content-Security-Policy'] = rctx.csp res.headers['Content-Security-Policy'] = rctx.csp
# /api/* is reserved for various API implementations. Dispatch # /api/* is reserved for various API implementations. Dispatch
# accordingly. # accordingly. But URL paths can conflict with subrepos and virtual
if req.dispatchparts and req.dispatchparts[0] == b'api': # repos in hgwebdir. So until we have a workaround for this, only
# expose the URLs if the feature is enabled.
apienabled = rctx.repo.ui.configbool('experimental', 'web.apiserver')
if apienabled and req.dispatchparts and req.dispatchparts[0] == b'api':
wireprotoserver.handlewsgiapirequest(rctx, req, res, wireprotoserver.handlewsgiapirequest(rctx, req, res,
self.check_perm) self.check_perm)
return res.sendresponse() return res.sendresponse()
handled = wireprotoserver.handlewsgirequest( handled = wireprotoserver.handlewsgirequest(
rctx, req, res, self.check_perm) rctx, req, res, self.check_perm)
if handled: if handled:
return res.sendresponse() return res.sendresponse()

tests/test-http-api.t

$ send() { $ send() {
> hg --verbose debugwireproto --peer raw http://$LOCALIP:$HGPORT/ > hg --verbose debugwireproto --peer raw http://$LOCALIP:$HGPORT/
> } > }
$ hg init server $ hg init server
$ hg -R server serve -p $HGPORT -d --pid-file hg.pid $ hg -R server serve -p $HGPORT -d --pid-file hg.pid
$ cat hg.pid > $DAEMON_PIDS $ cat hg.pid > $DAEMON_PIDS
Request to /api fails unless web.apiserver is enabled Request to /api fails unless web.apiserver is enabled
$ send << EOF $ get-with-headers.py $LOCALIP:$HGPORT api
> httprequest GET api 400 no such method: api
> user-agent: test
> EOF
using raw connection to peer
s> GET /api HTTP/1.1\r\n
s> Accept-Encoding: identity\r\n
s> user-agent: test\r\n
s> host: $LOCALIP:$HGPORT\r\n (glob)
s> \r\n
s> makefile('rb', None)
s> HTTP/1.1 404 Not Found\r\n
s> Server: testing stub value\r\n
s> Date: $HTTP_DATE$\r\n
s> Content-Type: text/plain\r\n
s> Content-Length: 44\r\n
s> \r\n
s> Experimental API server endpoint not enabled
$ send << EOF <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
> httprequest GET api/ <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US">
> user-agent: test <head>
> EOF <link rel="icon" href="/static/hgicon.png" type="image/png" />
using raw connection to peer <meta name="robots" content="index, nofollow" />
s> GET /api/ HTTP/1.1\r\n <link rel="stylesheet" href="/static/style-paper.css" type="text/css" />
s> Accept-Encoding: identity\r\n <script type="text/javascript" src="/static/mercurial.js"></script>
s> user-agent: test\r\n
s> host: $LOCALIP:$HGPORT\r\n (glob) <title>$TESTTMP/server: error</title>
s> \r\n </head>
s> makefile('rb', None) <body>
s> HTTP/1.1 404 Not Found\r\n
s> Server: testing stub value\r\n <div class="container">
s> Date: $HTTP_DATE$\r\n <div class="menu">
s> Content-Type: text/plain\r\n <div class="logo">
s> Content-Length: 44\r\n <a href="https://mercurial-scm.org/">
s> \r\n <img src="/static/hglogo.png" width=75 height=90 border=0 alt="mercurial" /></a>
s> Experimental API server endpoint not enabled </div>
<ul>
<li><a href="/shortlog">log</a></li>
<li><a href="/graph">graph</a></li>
<li><a href="/tags">tags</a></li>
<li><a href="/bookmarks">bookmarks</a></li>
<li><a href="/branches">branches</a></li>
</ul>
<ul>
<li><a href="/help">help</a></li>
</ul>
</div>
<div class="main">
<h2 class="breadcrumb"><a href="/">Mercurial</a> </h2>
<h3>error</h3>
<form class="search" action="/log">
<p><input name="rev" id="search1" type="text" size="30" value="" /></p>
<div id="hint">Find changesets by keywords (author, files, the commit message), revision
number or hash, or <a href="/help/revsets">revset expression</a>.</div>
</form>
<div class="description">
<p>
An error occurred while processing your request:
</p>
<p>
no such method: api
</p>
</div>
</div>
</div>
</body>
</html>
[1]
$ get-with-headers.py $LOCALIP:$HGPORT api/
400 no such method: api
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US">
<head>
<link rel="icon" href="/static/hgicon.png" type="image/png" />
<meta name="robots" content="index, nofollow" />
<link rel="stylesheet" href="/static/style-paper.css" type="text/css" />
<script type="text/javascript" src="/static/mercurial.js"></script>
<title>$TESTTMP/server: error</title>
</head>
<body>
<div class="container">
<div class="menu">
<div class="logo">
<a href="https://mercurial-scm.org/">
<img src="/static/hglogo.png" width=75 height=90 border=0 alt="mercurial" /></a>
</div>
<ul>
<li><a href="/shortlog">log</a></li>
<li><a href="/graph">graph</a></li>
<li><a href="/tags">tags</a></li>
<li><a href="/bookmarks">bookmarks</a></li>
<li><a href="/branches">branches</a></li>
</ul>
<ul>
<li><a href="/help">help</a></li>
</ul>
</div>
<div class="main">
<h2 class="breadcrumb"><a href="/">Mercurial</a> </h2>
<h3>error</h3>
<form class="search" action="/log">
<p><input name="rev" id="search1" type="text" size="30" value="" /></p>
<div id="hint">Find changesets by keywords (author, files, the commit message), revision
number or hash, or <a href="/help/revsets">revset expression</a>.</div>
</form>
<div class="description">
<p>
An error occurred while processing your request:
</p>
<p>
no such method: api
</p>
</div>
</div>
</div>
</body>
</html>
[1]
Restart server with support for API server Restart server with support for API server
$ killdaemons.py $ killdaemons.py
$ cat > server/.hg/hgrc << EOF $ cat > server/.hg/hgrc << EOF
> [experimental] > [experimental]
> web.apiserver = true > web.apiserver = true
> EOF > EOF