subrepo: add tests for hg rogue ssh urls (SEC)
'ssh://' has an exploit that will pass the url blindly to the ssh
command, allowing a malicious person to have a subrepo with
'-oProxyCommand' which could run arbitrary code on a user's machine. In
addition, at least on Windows, a pipe '|' is able to execute arbitrary
commands.
When this happens, let's throw a big abort into the user's face so that
they can inspect what's going on.
#!/usr/bin/env python
#
# runrst - register custom roles and run correct writer
#
# Copyright 2010 Matt Mackall <mpm@selenic.com> and others
#
# This software may be used and distributed according to the terms of the
# GNU General Public License version 2 or any later version.
"""usage: %s WRITER args...
where WRITER is the name of a Docutils writer such as 'html' or 'manpage'
"""
import sys
try:
from docutils.parsers.rst import roles
from docutils.core import publish_cmdline
from docutils import nodes, utils
except ImportError:
sys.stderr.write("abort: couldn't generate documentation: docutils "
"module is missing\n")
sys.stderr.write("please install python-docutils or see "
"http://docutils.sourceforge.net/\n")
sys.exit(-1)
def role_hg(name, rawtext, text, lineno, inliner,
options={}, content=[]):
text = "hg " + utils.unescape(text)
linktext = nodes.literal(rawtext, text)
parts = text.split()
cmd, args = parts[1], parts[2:]
refuri = "hg.1.html#%s" % cmd
if cmd == 'help' and args:
if args[0] == 'config':
# :hg:`help config`
refuri = "hgrc.5.html"
elif args[0].startswith('config.'):
# :hg:`help config.SECTION...`
refuri = "hgrc.5.html#%s" % args[0].split('.', 2)[1]
elif len(args) >= 2 and args[0] == '-c':
# :hg:`help -c COMMAND ...` is equivalent to :hg:`COMMAND`
# (mainly for :hg:`help -c config`)
refuri = "hg.1.html#%s" % args[1]
else:
refuri = "hg.1.html#%s" % args[0]
node = nodes.reference(rawtext, '', linktext,
refuri=refuri)
return [node], []
roles.register_local_role("hg", role_hg)
if __name__ == "__main__":
if len(sys.argv) < 2:
sys.stderr.write(__doc__ % sys.argv[0])
sys.exit(1)
writer = sys.argv[1]
del sys.argv[1]
publish_cmdline(writer_name=writer)