This is an archive of the discontinued Mercurial Phabricator instance.

Differential D4523

narrow: validate patterns returned by expandnarrow
ClosedPublic

Authored by indygreg on Sep 11 2018, 2:52 PM.

Details

Reviewers
durin42
martinvonz
Group Reviewers
hg-reviewers
Commits
rHG55eea29833d2: narrow: validate patterns returned by expandnarrow
Summary

Remotes could supply malicious or invalid patterns. We should
validate them as soon as possible.

Diff Detail

Repository
rHG Mercurial
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

indygreg created this revision.Sep 11 2018, 2:52 PM
martinvonz accepted this revision.Sep 11 2018, 6:15 PM
This revision is now accepted and ready to land.Sep 11 2018, 6:15 PM
Closed by commit rHG55eea29833d2: narrow: validate patterns returned by expandnarrow (authored by indygreg). · Explain WhySep 11 2018, 6:46 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mhgext/narrow/narrowcommands.py (10 lines)

Diff 10900

hgext/narrow/narrowcommands.py

if not narrowspec.needsexpansion(includepats): if not narrowspec.needsexpansion(includepats):
return includepats, excludepats return includepats, excludepats
heads = pullop.heads or pullop.rheads heads = pullop.heads or pullop.rheads
includepats, excludepats = pullop.remote.expandnarrow( includepats, excludepats = pullop.remote.expandnarrow(
includepats, excludepats, heads) includepats, excludepats, heads)
pullop.repo.ui.debug('Expanded narrowspec to inc=%s, exc=%s\n' % ( pullop.repo.ui.debug('Expanded narrowspec to inc=%s, exc=%s\n' % (
includepats, excludepats)) includepats, excludepats))
return set(includepats), set(excludepats)
includepats = set(includepats)
excludepats = set(excludepats)
# Nefarious remote could supply unsafe patterns. Validate them.
narrowspec.validatepatterns(includepats)
narrowspec.validatepatterns(excludepats)
return includepats, excludepats
def clonenarrowcmd(orig, ui, repo, *args, **opts): def clonenarrowcmd(orig, ui, repo, *args, **opts):
"""Wraps clone command, so 'hg clone' first wraps localrepo.clone().""" """Wraps clone command, so 'hg clone' first wraps localrepo.clone()."""
opts = pycompat.byteskwargs(opts) opts = pycompat.byteskwargs(opts)
wrappedextraprepare = util.nullcontextmanager() wrappedextraprepare = util.nullcontextmanager()
opts_narrow = opts['narrow'] opts_narrow = opts['narrow']
narrowspecfile = opts['narrowspec'] narrowspecfile = opts['narrowspec']