tests/hgweberror.py

hgweb: extract path traversal checking into standalone function

A common exploit in web applications that access paths is to insert
path separator strings like ".." to try to get the server to serve up
files it shouldn't.

We have code for detecting this in staticfile(). A subsequent commit
will need to perform this test as well. Since this is security code,
let's factor the check so we don't have to reinvent the wheel.

# A dummy extension that installs an hgweb command that throws an Exception.

from __future__ import absolute_import

from mercurial.hgweb import (
    webcommands,
)

def raiseerror(web, req, tmpl):
    '''Dummy web command that raises an uncaught Exception.'''

    # Simulate an error after partial response.
    if 'partialresponse' in req.form:
        req.respond(200, 'text/plain')
        req.write('partial content\n')

    raise AttributeError('I am an uncaught error!')

def extsetup(ui):
    setattr(webcommands, 'raiseerror', raiseerror)
    webcommands.__all__.append('raiseerror')