contrib/hg-ssh

subrepo: handle 'C:' style paths on the command line (issue5770)

If you think 'C:' and 'C:\' are equivalent paths, see the inline comment before
proceeding.

The problem here was that several commands that take a URL argument (incoming,
outgoing, pull, and push) will use that value to set 'repo._subtoppath' on the
repository object after command specific manipulation of it, but before
converting it to an absolute path.  When an operation is performed on a relative
subrepo, subrepo._abssource() will posixpath.join() this value with the relative
subrepo path.  That adds a '/' after the drive letter, changing how it is
evaluated by abspath()/realpath() in vfsmod.vfs(..., realpath=True) as the
subrepo is instantiated.

I initially tried sanitizing the path in url.localpath(), because url.isabs()
only checks that it starts with a drive letter.  By the sample behavior, this is
clearly not an absolute path.  (Though the comment in isabs() is weasely- this
style path can't be joined either.)  But not everything funnels through there,
and it required explicitly calling localpath() in hg.parseurl() and assigning to
url.path to fix.  But then tests failed with urls like 'a#0'.

Next up was sanitizing the path in the url constructor.  That caused doctest
failures, because there are drive letter tests, so those got expanded in system
specific ways.  Yuya correctly pointed out that util.url is a parser, and
shouldn't be substituting the path too.

Rather than fixing every command call site, just convert it in the common
subrepo location.  I don't see any sanitizing on the path config options, so I
fixed those too.  Note that while the behavior is fixed here, there are still
places where 'comparing with C:' gets printed out, and that's not great for
debugging purposes.  (Specifically I saw it in `hg incoming -B C:`, without
subrepos.)  While clone will write out an absolute default path, I wonder what
would happen if a user edited that path to be 'C:'.  (I don't think supporting
relative paths in .hgrc is a sane thing to do, but while we're poking holes in
things...)

Since this is such an oddball case, it still leaks through in places, and there
seems to be a lot of duplicate url parsing, maybe the url parsing should be
moved to dispatch, and provide the command with a url object?  Then we could
convert this to an absolute path once, and not have to worry about it in the
rest of the code.

I also checked '--cwd C:' on the command line, and it was previously working
because os.chdir() will DTRT.

Finally, one other note from the url.localpath() experimenting.  I don't see any
cases where 'self._hostport' can hold a drive letter.  So I'm wondering if that
is wrong/old code.

#!/usr/bin/env python
#
# Copyright 2005-2007 by Intevation GmbH <[e-mail]>
#
# Author(s):
# Thomas Arendsen Hein <[e-mail]>
#
# This software may be used and distributed according to the terms of the
# GNU General Public License version 2 or any later version.

"""
hg-ssh - a wrapper for ssh access to a limited set of mercurial repos

To be used in ~/.ssh/authorized_keys with the "command" option, see sshd(8):
command="hg-ssh path/to/repo1 /path/to/repo2 ~/repo3 ~user/repo4" ssh-dss ...
(probably together with these other useful options:
 no-port-forwarding,no-X11-forwarding,no-agent-forwarding)

This allows pull/push over ssh from/to the repositories given as arguments.

If all your repositories are subdirectories of a common directory, you can
allow shorter paths with:
command="cd path/to/my/repositories && hg-ssh repo1 subdir/repo2"

You can use pattern matching of your normal shell, e.g.:
command="cd repos && hg-ssh user/thomas/* projects/{mercurial,foo}"

You can also add a --read-only flag to allow read-only access to a key, e.g.:
command="hg-ssh --read-only repos/*"
"""
from __future__ import absolute_import

import os
import shlex
import sys

# enable importing on demand to reduce startup time
import hgdemandimport ; hgdemandimport.enable()

from mercurial import (
    dispatch,
    ui as uimod,
)

def main():
    cwd = os.getcwd()
    readonly = False
    args = sys.argv[1:]
    while len(args):
        if args[0] == '--read-only':
            readonly = True
            args.pop(0)
        else:
            break
    allowed_paths = [os.path.normpath(os.path.join(cwd,
                                                   os.path.expanduser(path)))
                     for path in args]
    orig_cmd = os.getenv('SSH_ORIGINAL_COMMAND', '?')
    try:
        cmdargv = shlex.split(orig_cmd)
    except ValueError as e:
        sys.stderr.write('Illegal command "%s": %s\n' % (orig_cmd, e))
        sys.exit(255)

    if cmdargv[:2] == ['hg', '-R'] and cmdargv[3:] == ['serve', '--stdio']:
        path = cmdargv[2]
        repo = os.path.normpath(os.path.join(cwd, os.path.expanduser(path)))
        if repo in allowed_paths:
            cmd = ['-R', repo, 'serve', '--stdio']
            req = dispatch.request(cmd)
            if readonly:
                if not req.ui:
                    req.ui = uimod.ui.load()
                req.ui.setconfig('hooks', 'pretxnopen.hg-ssh',
                                 'python:__main__.rejectpush', 'hg-ssh')
                req.ui.setconfig('hooks', 'prepushkey.hg-ssh',
                                 'python:__main__.rejectpush', 'hg-ssh')
            dispatch.dispatch(req)
        else:
            sys.stderr.write('Illegal repository "%s"\n' % repo)
            sys.exit(255)
    else:
        sys.stderr.write('Illegal command "%s"\n' % orig_cmd)
        sys.exit(255)

def rejectpush(ui, **kwargs):
    ui.warn(("Permission denied\n"))
    # mercurial hooks use unix process conventions for hook return values
    # so a truthy return means failure
    return True

if __name__ == '__main__':
    main()