diff tests/test-audit-subrepo.t @ 41316:83377b4b4ae0 stable 4.9

subrepo: reject potentially unsafe subrepo paths (BC) (SEC)

In addition to the previous patch, this prohibits '~', '$nonexistent', etc.
for any subrepo types. I think this is safer, and real-world subrepos wouldn't
use such (local) paths.

--- a/tests/test-audit-subrepo.t	Tue Jan 08 22:07:45 2019 +0900
+++ b/tests/test-audit-subrepo.t	Tue Jan 08 22:19:36 2019 +0900
@@ -279,8 +279,9 @@
 on clone (and update) with various substitutions:
 
   $ hg clone -q main main2
+  abort: subrepo path contains illegal component: $SUB
+  [255]
   $ ls main2
-  $SUB
 
   $ SUB=sub1 hg clone -q main main3
   abort: subrepo path contains illegal component: $SUB
@@ -363,8 +364,9 @@
 Test tilde
 ----------
 
-The leading tilde may be expanded to $HOME, but it's a valid subrepo path.
-However, we might want to prohibit it as it seems potentially unsafe.
+The leading tilde may be expanded to $HOME, but it can be a valid subrepo
+path in theory. However, we want to prohibit it as there might be unsafe
+handling of such paths.
 
 on commit:
 
@@ -373,15 +375,32 @@
   $ hg init './~'
   $ echo '~ = ~' >> .hgsub
   $ hg ci -qAm 'add subrepo "~"'
-  $ ls
-  ~
+  abort: subrepo path contains illegal component: ~
+  [255]
+
+prepare tampered repo (including the commit above):
+
+  $ hg import --bypass -qm 'add subrepo "~"' - <<'EOF'
+  > diff --git a/.hgsub b/.hgsub
+  > new file mode 100644
+  > --- /dev/null
+  > +++ b/.hgsub
+  > @@ -0,0 +1,1 @@
+  > +~ = ~
+  > diff --git a/.hgsubstate b/.hgsubstate
+  > new file mode 100644
+  > --- /dev/null
+  > +++ b/.hgsubstate
+  > @@ -0,0 +1,1 @@
+  > +0000000000000000000000000000000000000000 ~
+  > EOF
   $ cd ..
 
 on clone (and update):
 
   $ hg clone -q tilde tilde2
-  $ ls tilde2
-  ~
+  abort: subrepo path contains illegal component: ~
+  [255]
 
 Test direct symlink traversal
 -----------------------------