comparison tests/test-audit-subrepo.t @ 34984:071cbeba4212 stable

subrepo: disallow symlink traversal across subrepo mount point (SEC)

It wasn't easy to extend the pathauditor to check symlink traversal across
subrepos because pathauditor._checkfs() rejects a directory having ".hg"
directory. That's why I added the explicit islink() check.

No idea if this patch is necessary after we've fixed the issue5730 by
splitting submerge() into planning and execution phases.

34983:80d7dbda9294

  $ cd hgsymdir/root
  $ ln -s ../out
  $ hg ci -qAm 'add symlink "out"'
  $ hg init ../out
  $ echo 'out = out' >> .hgsub
BROKEN: should fail
  $ hg ci -qAm 'add subrepo "out"'
  $ cd ../..

on clone (and update):

  $ mkdir hgsymdir2
BROKEN: should fail to update
  $ hg clone -q hgsymdir/root hgsymdir2/root
  $ ls hgsymdir2
  out
  root

#endif

Test indirect symlink traversal

34984:071cbeba4212

  $ cd hgsymdir/root
  $ ln -s ../out
  $ hg ci -qAm 'add symlink "out"'
  $ hg init ../out
  $ echo 'out = out' >> .hgsub
  $ hg ci -qAm 'add subrepo "out"'
  abort: subrepo 'out' traverses symbolic link
  [255]

prepare tampered repo (including the commit above):

  $ hg import --bypass -qm 'add subrepo "out"' - <<'EOF'
  > diff --git a/.hgsub b/.hgsub
  > new file mode 100644
  > --- /dev/null
  > +++ b/.hgsub
  > @@ -0,0 +1,1 @@
  > +out = out
  > diff --git a/.hgsubstate b/.hgsubstate
  > new file mode 100644
  > --- /dev/null
  > +++ b/.hgsubstate
  > @@ -0,0 +1,1 @@
  > +0000000000000000000000000000000000000000 out
  > EOF
  $ cd ../..

on clone (and update):

  $ mkdir hgsymdir2
  $ hg clone -q hgsymdir/root hgsymdir2/root
  abort: subrepo 'out' traverses symbolic link
  [255]
  $ ls hgsymdir2
  root

#endif

Test indirect symlink traversal