subrepo: add tests for hg rogue ssh urls (SEC)
'ssh://' has an exploit that will pass the url blindly to the ssh
command, allowing a malicious person to have a subrepo with
'-oProxyCommand' which could run arbitrary code on a user's machine. In
addition, at least on Windows, a pipe '|' is able to execute arbitrary
commands.
When this happens, let's throw a big abort into the user's face so that
they can inspect what's going on.
#require no-pure
A script to generate nasty diff worst-case scenarios:
$ cat > s.py <<EOF
> import random
> for x in xrange(100000):
> print
> if random.randint(0, 100) >= 50:
> x += 1
> print hex(x)
> EOF
$ hg init a
$ cd a
Check in a big file:
$ python ../s.py > a
$ hg ci -qAm0
Modify it:
$ python ../s.py > a
Time a check-in, should never take more than 10 seconds user time:
$ hg ci --time -m1
time: real .* secs .user [0-9][.].* sys .* (re)