subrepo: add tests for hg rogue ssh urls (SEC)
'ssh://' has an exploit that will pass the url blindly to the ssh
command, allowing a malicious person to have a subrepo with
'-oProxyCommand' which could run arbitrary code on a user's machine. In
addition, at least on Windows, a pipe '|' is able to execute arbitrary
commands.
When this happens, let's throw a big abort into the user's face so that
they can inspect what's going on.
====================================
Testing head checking code: Case A-2
====================================
Mercurial checks for the introduction of new heads on push. Evolution comes
into play to detect if existing branches on the server are being replaced by
some of the new one we push.
This case is part of a series of tests checking this behavior.
Category A: simple case involving a branch being superceeded by another.
TestCase 2: multi-changeset branch
.. old-state:
..
.. * 1 branch with 2 changesets
..
.. new-state:
..
.. * another 2-changeset branch succeeding the old one
..
.. expected-result:
..
.. * push allowed
..
.. graph-summary:
..
.. B ø⇠◔ B'
.. | |
.. A ø⇠◔ A'
.. |/
.. ●
$ . $TESTDIR/testlib/push-checkheads-util.sh
Test setup
----------
$ mkdir A2
$ cd A2
$ setuprepos
creating basic server and client repo
updating to branch default
2 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ cd server
$ mkcommit B0
$ cd ../client
$ hg pull
pulling from $TESTTMP/A2/server (glob)
searching for changes
adding changesets
adding manifests
adding file changes
added 1 changesets with 1 changes to 1 files
(run 'hg update' to get a working copy)
$ hg up 0
0 files updated, 0 files merged, 1 files removed, 0 files unresolved
$ mkcommit A1
created new head
$ mkcommit B1
$ hg debugobsolete `getid "desc(A0)" ` `getid "desc(A1)"`
$ hg debugobsolete `getid "desc(B0)" ` `getid "desc(B1)"`
$ hg log -G --hidden
@ 262c8c798096 (draft): B1
|
o f6082bc4ffef (draft): A1
|
| x d73caddc5533 (draft): B0
| |
| x 8aaa48160adc (draft): A0
|/
o 1e4be0697311 (public): root
Actual testing
--------------
$ hg push
pushing to $TESTTMP/A2/server (glob)
searching for changes
adding changesets
adding manifests
adding file changes
added 2 changesets with 2 changes to 2 files (+1 heads)
2 new obsolescence markers
$ cd ../..