contrib/linux-wheel-centos5-blacklist
author Sean Farley <sean@farley.io>
Mon, 31 Jul 2017 16:44:17 -0700
branchstable
changeset 33641 173ecccb9ee7
parent 32080 fcddcf442e4f
permissions -rw-r--r--
subrepo: add tests for svn rogue ssh urls (SEC) 'ssh://' has an exploit that will pass the url blindly to the ssh command, allowing a malicious person to have a subrepo with '-oProxyCommand' which could run arbitrary code on a user's machine. In addition, at least on Windows, a pipe '|' is able to execute arbitrary commands. When this happens, let's throw a big abort into the user's face so that they can inspect what's going on.

test-convert-git.t
test-subrepo-git.t
test-patchbomb-tls.t