hgext/children.py

subrepo: set GIT_ALLOW_PROTOCOL to limit git clone protocols (SEC)

CVE-2016-3068 (1/1)

Git's git-remote-ext remote helper provides an ext:: URL scheme that
allows running arbitrary shell commands. This feature allows
implementing simple git smart transports with a single shell shell
command. However, git submodules could clone arbitrary URLs specified
in the .gitmodules file. This was reported as CVE-2015-7545 and fixed
in git v2.6.1.

However, if a user directly clones a malicious ext URL, the git client
will still run arbitrary shell commands.

Mercurial is similarly effected. Mercurial allows specifying git
repositories as subrepositories. Git ext:: URLs can be specified as
Mercurial subrepositories allowing arbitrary shell commands to be run
on `hg clone ...`.


The Mercurial community would like to thank Blake Burkhart for
reporting this issue. The description of the issue is copied from
Blake's report.

This commit changes submodules to pass the GIT_ALLOW_PROTOCOL env
variable to git commands  with the same list of allowed protocols that
git submodule is using.

When the GIT_ALLOW_PROTOCOL env variable is already set, we just pass it
to git without modifications.

# Mercurial extension to provide the 'hg children' command
#
# Copyright 2007 by Intevation GmbH <[e-mail]>
#
# Author(s):
# Thomas Arendsen Hein <[e-mail]>
#
# This software may be used and distributed according to the terms of the
# GNU General Public License version 2 or any later version.

'''command to display child changesets (DEPRECATED)

This extension is deprecated. You should use :hg:`log -r
"children(REV)"` instead.
'''

from mercurial import cmdutil
from mercurial.commands import templateopts
from mercurial.i18n import _

cmdtable = {}
command = cmdutil.command(cmdtable)
# Note for extension authors: ONLY specify testedwith = 'internal' for
# extensions which SHIP WITH MERCURIAL. Non-mainline extensions should
# be specifying the version(s) of Mercurial they are tested with, or
# leave the attribute unspecified.
testedwith = 'internal'

@command('children',
    [('r', 'rev', '',
     _('show children of the specified revision'), _('REV')),
    ] + templateopts,
    _('hg children [-r REV] [FILE]'),
    inferrepo=True)
def children(ui, repo, file_=None, **opts):
    """show the children of the given or working directory revision

    Print the children of the working directory's revisions. If a
    revision is given via -r/--rev, the children of that revision will
    be printed. If a file argument is given, revision in which the
    file was last changed (after the working directory revision or the
    argument to --rev if given) is printed.

    Please use :hg:`log` instead::

        hg children => hg log -r 'children()'
        hg children -r REV => hg log -r 'children(REV)'

    See :hg:`help log` and :hg:`help revsets.children`.

    """
    rev = opts.get('rev')
    if file_:
        fctx = repo.filectx(file_, changeid=rev)
        childctxs = [fcctx.changectx() for fcctx in fctx.children()]
    else:
        ctx = repo[rev]
        childctxs = ctx.children()

    displayer = cmdutil.show_changeset(ui, repo, opts)
    for cctx in childctxs:
        displayer.show(cctx)
    displayer.close()