view tests/test-hgweb-csp.t @ 41979:0d467e4de4ae

discovery: fix embarrassing typo in slice definition

The code introduced in e514799e4e07 ended up having a silly bug. The indexing
selected a single item slice picking only p1. The discovery result was still
correct, but the sampling was hampered, sometime leading to much more round
trips being performed.

Fixing this issue restore the previous sampling behavior.

This fix has a negative performance impact on the pathological case the previous
test has been built.

# parent of this changesets
! wall 5.313884 comb 5.310000 user 5.260000 sys 0.050000 (best of 5)
! wall 6.711860 comb 6.710000 user 6.670000 sys 0.040000 (max of 5)
! wall 5.844016 comb 5.842000 user 5.784000 sys 0.058000 (avg of 5)
! wall 5.778635 comb 5.780000 user 5.740000 sys 0.040000 (median of 5)

# With this changesets.
! wall 6.350879 comb 6.350000 user 6.300000 sys 0.050000 (best of 5)
! wall 6.653647 comb 6.660000 user 6.480000 sys 0.180000 (max of 5)
! wall 6.492762 comb 6.494000 user 6.414000 sys 0.080000 (avg of 5)
! wall 6.547577 comb 6.550000 user 6.490000 sys 0.060000 (median of 5)

Changeset e514799e4e07 raised the question of using the "_uncheckedparentrevs"
instead of the current code. So I ran comparative timing:

# old code: 55919b96c02a (e514799e4e07 parent)
! wall 64.078708 comb 64.080000 user 63.160000 sys 0.920000 (best of 5)
! wall 68.296300 comb 68.290000 user 67.410000 sys 0.880000 (max of 5)
! wall 65.899075 comb 65.894000 user 65.082000 sys 0.812000 (avg of 5)
! wall 66.140286 comb 66.130000 user 65.330000 sys 0.800000 (median of 5)

# buggy code: e514799e4e07
! wall 46.605362 comb 46.610000 user 45.880000 sys 0.730000 (best of 5)
! wall 48.619659 comb 48.620000 user 47.890000 sys 0.730000 (max of 5)
! wall 47.350247 comb 47.350000 user 46.672000 sys 0.678000 (avg of 5)
! wall 46.983224 comb 46.980000 user 46.350000 sys 0.630000 (median of 5)

# fixed code: e514799e4e07 with this fix
! wall 55.858460 comb 55.850000 user 55.090000 sys 0.760000 (best of 5)
! wall 59.048805 comb 59.060000 user 58.110000 sys 0.950000 (max of 5)
! wall 57.192639 comb 57.192000 user 56.350000 sys 0.842000 (avg of 5)
! wall 57.056373 comb 57.060000 user 56.160000 sys 0.900000 (median of 5)

# version using uncheckedparents
! wall 56.471916 comb 56.470000 user 55.630000 sys 0.840000 (best of 5)
! wall 58.228793 comb 58.230000 user 57.600000 sys 0.630000 (max of 5)
! wall 57.377583 comb 57.378000 user 56.674000 sys 0.704000 (avg of 5)
! wall 57.008843 comb 57.010000 user 56.330000 sys 0.680000 (median of 5)

So it looks like the overhead from `_uncheckedparentrevs` is not that impactful.
I'll investigate this shortly. I'm almost done updating our benchmark suite
with more meaningful discovery cases.

#require serve

  $ cat > web.conf << EOF
  > [paths]
  > / = $TESTTMP/*
  > EOF

  $ hg init repo1
  $ cd repo1
  $ touch foo
  $ hg -q commit -A -m initial
  $ cd ..

  $ hg serve -p $HGPORT -d --pid-file=hg.pid --web-conf web.conf
  $ cat hg.pid >> $DAEMON_PIDS

repo index should not send Content-Security-Policy header by default

  $ get-with-headers.py --headeronly localhost:$HGPORT '' content-security-policy etag
  200 Script output follows

static page should not send CSP by default

  $ get-with-headers.py --headeronly localhost:$HGPORT static/mercurial.js content-security-policy etag
  200 Script output follows

repo page should not send CSP by default, should send ETag

  $ get-with-headers.py --headeronly localhost:$HGPORT repo1 content-security-policy etag
  200 Script output follows
  etag: W/"*" (glob)

  $ killdaemons.py

Configure CSP without nonce

  $ cat >> web.conf << EOF
  > [web]
  > csp = script-src https://example.com/ 'unsafe-inline'
  > EOF

  $ hg serve -p $HGPORT -d --pid-file=hg.pid --web-conf web.conf
  $ cat hg.pid > $DAEMON_PIDS

repo index should send Content-Security-Policy header when enabled

  $ get-with-headers.py --headeronly localhost:$HGPORT '' content-security-policy etag
  200 Script output follows
  content-security-policy: script-src https://example.com/ 'unsafe-inline'

static page should send CSP when enabled

  $ get-with-headers.py --headeronly localhost:$HGPORT static/mercurial.js content-security-policy etag
  200 Script output follows
  content-security-policy: script-src https://example.com/ 'unsafe-inline'

  $ get-with-headers.py --twice --headeronly localhost:$HGPORT repo1/static/style.css content-security-policy
  200 Script output follows
  content-security-policy: script-src https://example.com/ 'unsafe-inline'
  304 Not Modified
  content-security-policy: script-src https://example.com/ 'unsafe-inline'

repo page should send CSP by default, include etag w/o nonce

  $ get-with-headers.py --headeronly localhost:$HGPORT repo1 content-security-policy etag
  200 Script output follows
  content-security-policy: script-src https://example.com/ 'unsafe-inline'
  etag: W/"*" (glob)

nonce should not be added to html if CSP doesn't use it

  $ get-with-headers.py localhost:$HGPORT repo1/graph/tip | egrep 'content-security-policy|<script'
  <script type="text/javascript" src="/repo1/static/mercurial.js"></script>
  <script type="text/javascript">
  <script type="text/javascript">

Configure CSP with nonce

  $ killdaemons.py
  $ cat >> web.conf << EOF
  > csp = image-src 'self'; script-src https://example.com/ 'nonce-%nonce%'
  > EOF

  $ hg serve -p $HGPORT -d --pid-file=hg.pid --web-conf web.conf
  $ cat hg.pid > $DAEMON_PIDS

nonce should be substituted in CSP header

  $ get-with-headers.py --headeronly localhost:$HGPORT '' content-security-policy etag
  200 Script output follows
  content-security-policy: image-src 'self'; script-src https://example.com/ 'nonce-*' (glob)

nonce should be included in CSP for static pages

  $ get-with-headers.py --headeronly localhost:$HGPORT static/mercurial.js content-security-policy etag
  200 Script output follows
  content-security-policy: image-src 'self'; script-src https://example.com/ 'nonce-*' (glob)

repo page should have nonce, no ETag

  $ get-with-headers.py --headeronly localhost:$HGPORT repo1 content-security-policy etag
  200 Script output follows
  content-security-policy: image-src 'self'; script-src https://example.com/ 'nonce-*' (glob)

nonce should be added to html when used

  $ get-with-headers.py localhost:$HGPORT repo1/graph/tip content-security-policy | egrep 'content-security-policy|<script'
  content-security-policy: image-src 'self'; script-src https://example.com/ 'nonce-*' (glob)
  <script type="text/javascript" src="/repo1/static/mercurial.js"></script>
  <script type="text/javascript" nonce="*"> (glob)
  <script type="text/javascript" nonce="*"> (glob)

hgweb_mod w/o hgwebdir works as expected

  $ killdaemons.py

  $ hg serve -R repo1 -p $HGPORT -d --pid-file=hg.pid --config "web.csp=image-src 'self'; script-src https://example.com/ 'nonce-%nonce%'"
  $ cat hg.pid > $DAEMON_PIDS

static page sends CSP

  $ get-with-headers.py --headeronly localhost:$HGPORT static/mercurial.js content-security-policy etag
  200 Script output follows
  content-security-policy: image-src 'self'; script-src https://example.com/ 'nonce-*' (glob)

nonce included in <script> and headers

  $ get-with-headers.py localhost:$HGPORT graph/tip content-security-policy  | egrep 'content-security-policy|<script'
  content-security-policy: image-src 'self'; script-src https://example.com/ 'nonce-*' (glob)
  <script type="text/javascript" src="/static/mercurial.js"></script>
  <script type="text/javascript" nonce="*"> (glob)
  <script type="text/javascript" nonce="*"> (glob)