comparison mercurial/subrepo.py @ 41457:6c10eba6b9cd stable

subrepo: prohibit variable expansion on creation of hg subrepo (SEC)

It's probably wrong to expand path at localrepo.*repository() layer, but
fixing the layering issue would require careful inspection of call paths.
So, this patch adds add a validation to the subrepo constructor.

os.path.realpath(util.expandpath(root)) is what vfsmod.vfs() would do.

41456:31286c9282df

        super(hgsubrepo, self).__init__(ctx, path)
        self._state = state
        r = ctx.repo()
        root = r.wjoin(path)
        create = allowcreate and not r.wvfs.exists('%s/.hg' % path)
        self._repo = hg.repository(r.baseui, root, create=create)

        # Propagate the parent's --hidden option
        if r is r.unfiltered():
            self._repo = self._repo.unfiltered()

41457:6c10eba6b9cd

        super(hgsubrepo, self).__init__(ctx, path)
        self._state = state
        r = ctx.repo()
        root = r.wjoin(path)
        create = allowcreate and not r.wvfs.exists('%s/.hg' % path)
        # repository constructor does expand variables in path, which is
        # unsafe since subrepo path might come from untrusted source.
        if os.path.realpath(util.expandpath(root)) != root:
            raise error.Abort(_('subrepo path contains illegal component: %s')
                              % path)
        self._repo = hg.repository(r.baseui, root, create=create)
        if self._repo.root != root:
            raise error.ProgrammingError('failed to reject unsafe subrepo '
                                         'path: %s (expanded to %s)'
                                         % (root, self._repo.root))

        # Propagate the parent's --hidden option
        if r is r.unfiltered():
            self._repo = self._repo.unfiltered()