comparison mercurial/subrepo.py @ 34984:071cbeba4212 stable

subrepo: disallow symlink traversal across subrepo mount point (SEC)

It wasn't easy to extend the pathauditor to check symlink traversal across
subrepos because pathauditor._checkfs() rejects a directory having ".hg"
directory. That's why I added the explicit islink() check.

No idea if this patch is necessary after we've fixed the issue5730 by
splitting submerge() into planning and execution phases.

34983:80d7dbda9294

            if f.lower() == 'hgrc':
                ui.warn(_("warning: removing potentially hostile 'hgrc' "
                          "in '%s'\n") % vfs.join(dirname))
                vfs.unlink(vfs.reljoin(dirname, f))

def subrepo(ctx, path, allowwdir=False, allowcreate=True):
    """return instance of the right subrepo class for subrepo in path"""
    # subrepo inherently violates our import layering rules
    # because it wants to make repo objects from deep inside the stack
    # so we manually delay the circular imports to not break
    # scripts that don't use our demand-loading
    global hg
    from . import hg as h
    hg = h

    pathutil.pathauditor(ctx.repo().root)(path)
    state = ctx.substate[path]
    if state[2] not in types:
        raise error.Abort(_('unknown subrepo type %s') % state[2])
    if allowwdir:
        state = (state[0], ctx.subrev(path), state[2])

    # scripts that don't use our demand-loading
    global hg
    from . import hg as h
    hg = h

    pathutil.pathauditor(ctx.repo().root)(path)
    state = ctx.substate[path]
    if state[2] not in types:
        raise error.Abort(_('unknown subrepo type %s') % state[2])
    subrev = ''
    if state[2] == 'hg':

34984:071cbeba4212

            if f.lower() == 'hgrc':
                ui.warn(_("warning: removing potentially hostile 'hgrc' "
                          "in '%s'\n") % vfs.join(dirname))
                vfs.unlink(vfs.reljoin(dirname, f))

def _auditsubrepopath(repo, path):
    # auditor doesn't check if the path itself is a symlink
    pathutil.pathauditor(repo.root)(path)
    if repo.wvfs.islink(path):
        raise error.Abort(_("subrepo '%s' traverses symbolic link") % path)

def subrepo(ctx, path, allowwdir=False, allowcreate=True):
    """return instance of the right subrepo class for subrepo in path"""
    # subrepo inherently violates our import layering rules
    # because it wants to make repo objects from deep inside the stack
    # so we manually delay the circular imports to not break
    # scripts that don't use our demand-loading
    global hg
    from . import hg as h
    hg = h

    _auditsubrepopath(ctx.repo(), path)
    state = ctx.substate[path]
    if state[2] not in types:
        raise error.Abort(_('unknown subrepo type %s') % state[2])
    if allowwdir:
        state = (state[0], ctx.subrev(path), state[2])

    # scripts that don't use our demand-loading
    global hg
    from . import hg as h
    hg = h

    _auditsubrepopath(ctx.repo(), path)
    state = ctx.substate[path]
    if state[2] not in types:
        raise error.Abort(_('unknown subrepo type %s') % state[2])
    subrev = ''
    if state[2] == 'hg':