Change Details

Flags after '--' should not be effective. That's a universal rule across common software. People should be able to hg log a file named `--debugger`. Besides, hg ... -- --profile --traceback` should not enable profiling or traceback. This patch changes the handling of `--debugger`, `--profile`, `--traceback` so they are ineffective after `--`. This makes other software easier to deal with command line flags injection by adding `--` before user input. See https://hackerone.com/reports/288704 Those flags are only used for developers. So this BC looks fine.

Flags after `--` should not be effective. That`s a universal rule across common software. People should be able to hg log a file named `--debugger`. Besides, hg ... -- --profile --traceback` should not enable profiling or traceback. This patch changes the handling of `--debugger`, `--profile`, `--traceback` so they are ineffective after `--`. This makes other software easier to deal with command line flags injection by adding `--` before user input. See https://hackerone.com/reports/288704 Those flags are only used for developers. So this BC looks fine. .. bc:: Certain global flags (`--debugger`, `--profile`, and `--traceback`) are no longer effective after `--`.

Flags after '--'`--` should not be effective. That's`s a universal rule across common software. People should be able to hg log a file named `--debugger`. Besides, hg ... -- --profile --traceback` should not enable profiling or traceback. This patch changes the handling of `--debugger`, `--profile`, `--traceback` so they are ineffective after `--`. This makes other software easier to deal with command line flags injection by adding `--` before user input. See https://hackerone.com/reports/288704 Those flags are only used for developers. So this BC looks fine. .. bc:: Certain global flags (`--debugger`, `--profile`, and `--traceback`) are no longer effective after `--`.