--- a/tests/test-subrepo-svn.t Mon Jul 31 16:04:44 2017 -0700
+++ b/tests/test-subrepo-svn.t Mon Jul 31 16:44:17 2017 -0700
@@ -639,3 +639,67 @@
$ hg update -q -C '.^1'
$ cd ../..
+
+SEC: test for ssh exploit
+
+ $ hg init ssh-vuln
+ $ cd ssh-vuln
+ $ echo "s = [svn]$SVNREPOURL/src" >> .hgsub
+ $ svn co --quiet "$SVNREPOURL"/src s
+ $ hg add .hgsub
+ $ hg ci -m1
+ $ echo "s = [svn]svn+ssh://-oProxyCommand=touch%20owned%20nested" > .hgsub
+ $ hg ci -m2
+ $ cd ..
+ $ hg clone ssh-vuln ssh-vuln-clone
+ updating to branch default
+ abort: potentially unsafe url: 'svn+ssh://-oProxyCommand=touch owned nested' (in subrepo s)
+ [255]
+
+also check that a percent encoded '-' (%2D) doesn't work
+
+ $ cd ssh-vuln
+ $ echo "s = [svn]svn+ssh://%2DoProxyCommand=touch%20owned%20nested" > .hgsub
+ $ hg ci -m3
+ $ cd ..
+ $ rm -r ssh-vuln-clone
+ $ hg clone ssh-vuln ssh-vuln-clone
+ updating to branch default
+ abort: potentially unsafe url: 'svn+ssh://-oProxyCommand=touch owned nested' (in subrepo s)
+ [255]
+
+also check for a pipe
+
+ $ cd ssh-vuln
+ $ echo "s = [svn]svn+ssh://fakehost|sh%20nested" > .hgsub
+ $ hg ci -m3
+ $ cd ..
+ $ rm -r ssh-vuln-clone
+ $ hg clone ssh-vuln ssh-vuln-clone
+ updating to branch default
+ abort: potentially unsafe url: 'svn+ssh://fakehost|sh nested' (in subrepo s)
+ [255]
+
+also check that a percent encoded '|' (%7C) doesn't work
+
+ $ cd ssh-vuln
+ $ echo "s = [svn]svn+ssh://fakehost%7Csh%20nested" > .hgsub
+ $ hg ci -m3
+ $ cd ..
+ $ rm -r ssh-vuln-clone
+ $ hg clone ssh-vuln ssh-vuln-clone
+ updating to branch default
+ abort: potentially unsafe url: 'svn+ssh://fakehost|sh nested' (in subrepo s)
+ [255]
+
+also check that hiding the attack in the username doesn't work:
+
+ $ cd ssh-vuln
+ $ echo "s = [svn]svn+ssh://%2DoProxyCommand=touch%20owned%20foo@example.com/nested" > .hgsub
+ $ hg ci -m3
+ $ cd ..
+ $ rm -r ssh-vuln-clone
+ $ hg clone ssh-vuln ssh-vuln-clone
+ updating to branch default
+ abort: potentially unsafe url: 'svn+ssh://-oProxyCommand=touch owned foo@example.com/nested' (in subrepo s)
+ [255]