wireprotoserver: remove support for do_<command> handlers (API) Old versions of wire protocol handlers relied on methods named do_<command> to handle wire protocol commands. The last definition of these methods on sshserver was removed by 9f6e0e7ef828 ~2 years ago. I think it's time to not support this mechanism for defining command handlers. .. api:: sshserver no longers looks for wire protocol command handlers in methods named do_<command>. Use @wireproto.wireprotocommand to declare wire protocol command handler functions. Differential Revision: https://phab.mercurial-scm.org/D1985

wireprotoserver: make attributes private These aren't part of the protocol interface. So they should be _ prefixed. Differential Revision: https://phab.mercurial-scm.org/D1984

wireprotoserver: remove unused response attribute I think the last use of this attribute was removed by 2f8adc60e013 in 2010. Differential Revision: https://phab.mercurial-scm.org/D1983

wireprotoserver: rename p to proto To aid readability. And to make it easier to search the code base for protocol instances. Differential Revision: https://phab.mercurial-scm.org/D1982

wireprotoserver: add some blank lines between methods Let's make this file slightly easier to read. Differential Revision: https://phab.mercurial-scm.org/D1981

tests: start a set of unit tests for mdiff.py, starting with splitnewlines I want to optimize splitnewlines, so writing tests seems prudent. Differential Revision: https://phab.mercurial-scm.org/D1972 # no-check-commit because of test_ funciton

perf: add a perfunidiff command for benchmarking unified diff speed Differential Revision: https://phab.mercurial-scm.org/D1971

wireprotoserver: move abstractserverproto class from wireproto Let's have the interface live next to things that define it. Differential Revision: https://phab.mercurial-scm.org/D1969

wireprotoserver: move sshserver into module (API) Let's welcome the SSH protocol handler to our new central home for protocol handlers. .. api:: Content from mercurial.sshserver has been moved into mercurial.wireprotoserver. Differential Revision: https://phab.mercurial-scm.org/D1968 # no-check-commit because we're moving a foo_bar function

wireprotoserver: don't import symbol from hgweb.common Importing hgweb.common requires importing hgweb. hgweb/__init__.py contains a bit of code and does imports of large parts of the hgweb.* module tree. All we need is a constant defining the integer status code for HTTP OK. So just redefine HTTP_OK in wireprotoserver.py and avoid the excessive imports. Differential Revision: https://phab.mercurial-scm.org/D1967

wireprotoserver: rename call to callhttp In the context of multiple handlers, call() is ambiguous. Differential Revision: https://phab.mercurial-scm.org/D1966

wireprotoserver: rename hgweb.protocol to wireprotoserver (API) The HTTP wire protocol server / response handler is currently defined in the hgweb sub-package. That only kind of makes sense. hgweb does contain most of the HTTP server code. However, hgweb is more tailored for providing HTTP server and WSGI scaffolding and serving hgweb requests. The wire protocol is kind of its own beast. In addition, the code for HTTP and SSH wire protocol handling is actually pretty small and it needs to stay in sync to ensure parity between the transport implementations. We rename mercurial/hgweb/protocol.py to mercurial/wireprotoserver.py. The new module will eventually become the home of the SSH handler as well. .. api:: Content from mercurial.hgweb.protocol has been moved to mercurial.wireprotoserver. Differential Revision: https://phab.mercurial-scm.org/D1965

testrunner: fix updating of .testtimes file We attempt to write the 5 most recent test timings to a file called .testtimes, but we read previous results from a file called .testtimes- (including the hyphen), so we ended up no more than a single time per test. Differential Revision: https://phab.mercurial-scm.org/D1961

testrunner: make reading of test times work with #testcases Due to a bug that will be fixed in the next patch, we never actually read back .testcases, so we didn't notice that it could not be parsed successfully when there are #testcases tests. The parsing failed on lines like "test-amend-subrepo.t (case obsstore-off) 32.420" because we used a simple string.split() call and expected all parts but the first to be floating point numbers (and "(case" isn't, for example). Fix by using a regex instead. Differential Revision: https://phab.mercurial-scm.org/D1960

tests: allow [Errno] in output I'm not sure why, but my system is printing "[Errno -5]" before the "No address associated with hostname" message. I suspect a modern version of Python improved errno tracking or something. Add an "[Errno ...]" pattern as optional output to make the test pass. Differential Revision: https://phab.mercurial-scm.org/D1958

mdiff: remove rewindhunk by yielding a bool first to indicate data Differential Revision: https://phab.mercurial-scm.org/D1942

mdiff: explicitly compute places for the newline marker Differential Revision: https://phab.mercurial-scm.org/D1941

patch: avoid repeated binary checks if all files in a patch are text Differential Revision: https://phab.mercurial-scm.org/D1940

setdiscovery: don't call "heads" wire command when heads specified Our custom server has too many heads to announce (one per code review, plus a public head), but it still lets the user request one of them by doing hg pull -r <some expression> After the client has resolved the expression to a set of nodeids by calling the "lookup" wire command, it will start the discovery phase. Before this patch, that doesn't take the requested heads into account and unconditionally calls the server's "heads" command to find all its heads. One consequence of that the "all remote heads known locally" case triggers if the client already had the public head and the user will see a "no changes found" message that's unrelated to the head they requested. That message confused me for a while. More imporantly, it also means that pullop.cgresult incorrectly (given our arguably misbehaving server) gets set to 0 (no changesets added), which confused some of our extensions. This patch makes it so the client skips the "heads" command if the user requested specific revisions. Since the "heads" command is normally batched with the first "known" command and calculating the list of heads is probably cheap, I don't expect much improvement in speed from this. Differential Revision: https://phab.mercurial-scm.org/D1962

testrunner: on error, color the "(case xxx)" part the same as filename When using #testcases, the lines that read something like ERROR: test-split.t (case obsstore-off) output changed get colored red and the filename gets highlighted with a brighter red. This makes it harder to notice the "case obsstore-off" part, but it does seem important, so let's highlight it. Differential Revision: https://phab.mercurial-scm.org/D1959

python3: whitelist an additional 23 passing tests Differential Revision: https://phab.mercurial-scm.org/D1908

tests: fix a missed b prefix in a test extension in test-strip.t # skip-blame just a bytes prefix Differential Revision: https://phab.mercurial-scm.org/D1907

revlog: correct type in check to verify rawtext is immutable This fixes far more failures than I feel like it has any right to, so there's clearly some subtle interaction between self._cache and other parts of this code. :( Differential Revision: https://phab.mercurial-scm.org/D1906

mq: use bytes() instead of str() to encode statusentries for writing Differential Revision: https://phab.mercurial-scm.org/D1903

mq: open status file et al in bytes mode Differential Revision: https://phab.mercurial-scm.org/D1902

mq: fix up statusentry to be both repr()-able and bytes()-able Differential Revision: https://phab.mercurial-scm.org/D1901

python3: whitelist another 7 passing tests Differential Revision: https://phab.mercurial-scm.org/D1900

localrepo: pass transaction kwargs as strings, not bytes Differential Revision: https://phab.mercurial-scm.org/D1899

localrepo: consistently use native str when __dict__ is involved Differential Revision: https://phab.mercurial-scm.org/D1898

smartset: use native string when peeking in __dict__ # skip-blame just an r prefix on a string literal Differential Revision: https://phab.mercurial-scm.org/D1897

obsolete: use native string when peeking in __dict__ # skip-blame just an r prefix on a few string literals Differential Revision: https://phab.mercurial-scm.org/D1896

lsprof: use native string when peeking in __dict__ # skip-blame just an r prefix on a string literal Differential Revision: https://phab.mercurial-scm.org/D1895

dirstate: use native strings when peeking in __dict__ # skip-blame because we're just adding a prefix on a string prefix Differential Revision: https://phab.mercurial-scm.org/D1894

context: use native string when peeking in __dict__ # skip-blame because we're just adding a prefix on a string constant Differential Revision: https://phab.mercurial-scm.org/D1893

bundlerepo: use native str when peeking in __dict__ # skip-blame since it's just a string constant prefix Differential Revision: https://phab.mercurial-scm.org/D1892

transaction: fix hg version check when loading journal Differential Revision: https://phab.mercurial-scm.org/D1891

branchmap: make error messages consistent between Python 2 and 3 Differential Revision: https://phab.mercurial-scm.org/D1890

tests: bytestring-ify all the adhoc extensions in test-strip.t # skip-blame because we're just adding b'' Differential Revision: https://phab.mercurial-scm.org/D1889

filemerge: fix regular expression pattern to be bytes # skip-blame just a bytes prefix Differential Revision: https://phab.mercurial-scm.org/D1888

tags: explicitly grab list of dict keys Differential Revision: https://phab.mercurial-scm.org/D1887

commands: replace map() with list comprehension This will work identically on Python 2 and 3. Differential Revision: https://phab.mercurial-scm.org/D1886

commands: rewrite legacy ternary operator hack using modern syntax Differential Revision: https://phab.mercurial-scm.org/D1885

strip: use %d for known-int string interpolation Differential Revision: https://phab.mercurial-scm.org/D1884

strip: use in-place revset formatspec instead of %-formatting ourselves Caught by Yuya during review of D1884. Differential Revision: https://phab.mercurial-scm.org/D1905

tests: get run-tests to reliably hand shellquote a string and not a bytes Differential Revision: https://phab.mercurial-scm.org/D1883

revsetlang: fix a doctest example on Python 3 # skip-blame because it's just some bytes prefixes Differential Revision: https://phab.mercurial-scm.org/D1964

merge with stable

Added signature for changeset 7de7bd407251

Added tag 4.5.3 for changeset 7de7bd407251

server: ensure the incoming request falls under the prefix value Prior to this, the first test asserted in wsgiref.validate.check_environ() saying PATH didn't start with '/', but the second test served up the repo. The assertion was just added in this cycle (though the value of PATH is still wrong without the assertion). Allowing access to the repo at any URL outside of the prefix is a long standing bug. This also affected hgwebdir, at least when used via --subrepo. Paths are not being canonicalized, so accesses to things like 'foo/../bar' will get tossed out here, unless the prefix also matches.

rebase: on abort, don't strip commits that didn't need rebased (issue5822) I clearly missed adding this condition in 78496ac30025 (rebase: allow rebase even if some revisions need no rebase (BC) (issue5422), 2017-05-11). Perhaps I should have opted for the "revdone" solution I mentioned there... Differential Revision: https://phab.mercurial-scm.org/D2879

rebase: avoid defining two lists with the same contents In abort(), there's "dstates" and "rebased" that are identical, which they seem to have been since 0806823370d8 (rebase: properly calculate descendant set when aborting (issue3332), 2012-03-22). Let's de-duplicate. I don't know what "dstates" means, but "rebased" makes sense (it's the list of rebased revisions), so let's pick that. Differential Revision: https://phab.mercurial-scm.org/D2878

tests: demonstrate aborted rebase strips commits that didn't need rebasing I haven't verified, but this has probably been broken ever since I added the feature in 78496ac30025 (rebase: allow rebase even if some revisions need no rebase (BC) (issue5422), 2017-05-11). Differential Revision: https://phab.mercurial-scm.org/D2877

hgweb: garbage collect on every request There appears to be a cycle in localrepository or hgweb that is preventing repositories from being garbage collected when hgwebdir dispatches to hgweb. Every request creates a new repository instance and then leaks that object and other referenced objects. A periodic GC to find cycles will eventually collect the old repositories. But these don't run reliably and rapid requests to hgwebdir can result in rapidly increasing memory consumption. With the Firefox repository, repeated requests to raw-file URLs leak ~100 MB per hgwebdir request (most of this appears to be cached manifest data structures). WSGI processes quickly grow to >1 GB RSS. Breaking the cycles in localrepository is going to be a bit of work. Because we know that hgwebdir leaks localrepository instances, let's put a band aid on the problem in the form of an explicit gc.collect() on every hgwebdir request. As the inline comment states, ideally we'd do this in a finally block for the current request iff it dispatches to hgweb. But _runwsgi() returns an explicit value. We need the finally to run after generator exhaustion. So we'd need to refactor _runwsgi() to "yield" instead of "return." That's too much change for a patch to stable. So we implement this hack one function above and run it on every request. The performance impact of this change should be minimal. Any impact should be offset by benefits from not having hgwebdir processes leak memory.

amend: abort if unresolved merge conflicts found (issue5805) It was checked by repo.commit() before e8a7c1a0565a "cmdutil: remove the redundant commit during amend."

Added signature for changeset 8bba684efde7

Added tag 4.5.2 for changeset 8bba684efde7

merge with security patches

hgweb: always perform permissions checks on protocol commands (BC) (SEC) Previously, the HTTP request handling code would only perform permissions checking on a wire protocol command if that wire protocol command defined its permissions / operation type. This meant that commands (possibly provided by extensions) not defining their operation type would bypass permissions check. This could lead to exfiltration of data from servers and mutating repositories that were supposed to be read-only. This security issue has been present since the permissions table was introduced by d3147b4e3e8a in 2008. This commit changes the behavior of the HTTP server to always perform permissions checking for protocol requests. If an explicit permission for a wire protocol command is not defined, the server assumes the command can be used for writing and governs access accordingly. .. bc:: Wire protocol commands not defining their operation type in ``wireproto.PERMISSIONS`` are now assumed to be used for "push" operations and access control to run those commands is now enforced accordingly.

wireproto: check permissions when executing "batch" command (BC) (SEC) For as long as the "batch" command has existed (introduced by bd88561afb4b and first released as part of Mercurial 1.9), that command (like most wire commands introduced after 2008) lacked an entry in the hgweb permissions table. And since we don't verify permissions if an entry is missing from the permissions table, this meant that executing a command via "batch" would bypass all permissions checks. The security implications are significant: a Mercurial HTTP server would allow writes via "batch" wire protocol commands as long as the HTTP request were processed by Mercurial and the process running the Mercurial HTTP server had write access to the repository. The Mercurial defaults of servers being read-only and the various web.* config options to define access control were bypassed. In addition, "batch" could be used to exfiltrate data from servers that were configured to not allow read access. Both forms of permissions bypass could be mitigated to some extent by using HTTP authentication. This would prevent HTTP requests from hitting Mercurial's server logic. However, any authenticated request would still be able to bypass permissions checks via "batch" commands. The easiest exploit was to send "pushkey" commands via "batch" and modify the state of bookmarks, phases, and obsolescence markers. However, I suspect a well-crafted HTTP request could trick the server into running the "unbundle" wire protocol command, effectively performing a full `hg push` to create new changesets on the remote. This commit plugs this gaping security hole by having the "batch" command perform permissions checking on each sub-command that is being batched. We do this by threading a permissions checking callable all the way to the protocol handler. The threading is a bit hacky from a code perspective. But it preserves API compatibility, which is the proper thing to do on the stable branch. One of the subtle things we do is assume that a command with an undefined permission is a "push" command. This is the safest thing to do from a security perspective: we don't want to take chances that a command could perform a write even though the server is configured to not allow writes. As the test changes demonstrate, it is no longer possible to bypass permissions via the "batch" wire protocol command. .. bc:: The "batch" wire protocol command now enforces permissions of each invoked sub-command. Wire protocol commands must define their operation type or the "batch" command will assume they can write data and will prevent their execution on HTTP servers unless the HTTP request method is POST, the server is configured to allow pushes, and the (possibly authenticated) HTTP user is authorized to perform a push.