view hgext/interhg.py @ 18888:19d489404d79

smtp: verify the certificate of the SMTP server for STARTTLS/SMTPS

Before this patch, the certificate of the SMTP server for STARTTLS or
SMTPS isn't verified.

This may cause man-in-the-middle security problem (stealing
authentication information), even though SMTP channel itself is
encrypted by SSL.

When "[smtp] tls" is configured as "smtps" or "starttls", this patch:

  - uses classes introduced by preceding patches instead of "SMTP" or
    "SMTP_SSL" of smtplib, and

  - verifies the certificate of the SMTP server, if "[smtp]
    verifycert" is configured as other than False

"[smtp] verifycert" can be configured in 3 levels:

  - "strict":

    This verifies peer certificate, and aborts if:

      - peer certification is not valid, or
      - no configuration in "[hostfingerprints]" and "[web] cacerts"

    This is default value of "[smtp] verifycert" for security.

  - "loose":

    This verifies peer certificate, and aborts if peer certification is
    not valid.

    This just shows warning message ("certificate not verified"), if
    there is no configuration in "[hostfingerprints]" and "[web]
    cacerts".

    This is as same as verification for HTTPS connection.

  - False(no verification):

    Peer certificate is not verified.

    This is as same as the behavior before this patch series.

"hg email --insecure" uses "loose" level, and ignores "[web] cacerts"
as same as push/pull/etc... with --insecure.

Ignoring "[web] cacerts" configuration for "hg email --insecure" is
already done in "dispatch._dispatch()" by looking "insecure" up in the
table of command options.

# interhg.py - interhg
#
# Copyright 2007 OHASHI Hideya <[e-mail]>
#
# Contributor(s):
#   Edward Lee <[e-mail]>
#
# This software may be used and distributed according to the terms of the
# GNU General Public License version 2 or any later version.

'''expand expressions into changelog and summaries

This extension allows the use of a special syntax in summaries, which
will be automatically expanded into links or any other arbitrary
expression, much like InterWiki does.

A few example patterns (link to bug tracking, etc.) that may be used
in your hgrc::

  [interhg]
  issues = s!issue(\\d+)!<a href="http://bts/issue\\1">issue\\1</a>!
  bugzilla = s!((?:bug|b=|(?=#?\\d{4,}))(?:\\s*#?)(\\d+))!<a..=\\2">\\1</a>!i
  boldify = s!(^|\\s)#(\\d+)\\b! <b>#\\2</b>!
'''

import re
from mercurial.hgweb import hgweb_mod
from mercurial import templatefilters, extensions
from mercurial.i18n import _

testedwith = 'internal'

interhg_table = []

def uisetup(ui):
    orig_escape = templatefilters.filters["escape"]

    def interhg_escape(x):
        escstr = orig_escape(x)
        for regexp, format in interhg_table:
            escstr = regexp.sub(format, escstr)
        return escstr

    templatefilters.filters["escape"] = interhg_escape

def interhg_refresh(orig, self, *args, **kwargs):
    interhg_table[:] = []
    for key, pattern in self.repo.ui.configitems('interhg'):
        # grab the delimiter from the character after the "s"
        unesc = pattern[1]
        delim = re.escape(unesc)

        # identify portions of the pattern, taking care to avoid escaped
        # delimiters. the replace format and flags are optional, but delimiters
        # are required.
        match = re.match(r'^s%s(.+)(?:(?<=\\\\)|(?<!\\))%s(.*)%s([ilmsux])*$'
                         % (delim, delim, delim), pattern)
        if not match:
            self.repo.ui.warn(_("interhg: invalid pattern for %s: %s\n")
                              % (key, pattern))
            continue

        # we need to unescape the delimiter for regexp and format
        delim_re = re.compile(r'(?<!\\)\\%s' % delim)
        regexp = delim_re.sub(unesc, match.group(1))
        format = delim_re.sub(unesc, match.group(2))

        # the pattern allows for 6 regexp flags, so set them if necessary
        flagin = match.group(3)
        flags = 0
        if flagin:
            for flag in flagin.upper():
                flags |= re.__dict__[flag]

        try:
            regexp = re.compile(regexp, flags)
            interhg_table.append((regexp, format))
        except re.error:
            self.repo.ui.warn(_("interhg: invalid regexp for %s: %s\n")
                              % (key, regexp))
    return orig(self, *args, **kwargs)

extensions.wrapfunction(hgweb_mod.hgweb, 'refresh', interhg_refresh)