view tests/test-convert-svn-tags.t @ 29051:a56296f55a5e stable 3.8.1

convert: pass absolute paths to git (SEC)

Fixes CVE-2016-3105 (1/1).

Previously, it was possible for the repository path passed to git-ls-remote
to be misinterpreted as a URL.

Always passing an absolute path to git is a simple way to avoid this.

#require svn svn-bindings

  $ cat >> $HGRCPATH <<EOF
  > [extensions]
  > convert =
  > EOF

  $ svnadmin create svn-repo
  $ svnadmin load -q svn-repo < "$TESTDIR/svn/tags.svndump"

Convert
  $ hg convert --datesort svn-repo A-hg
  initializing destination A-hg repository
  scanning source...
  sorting...
  converting...
  5 init projA
  4 adda
  3 changea
  2 changea2
  1 changea3
  0 changea
  updating tags

  $ cd A-hg
  $ hg log -G --template '{rev} {desc|firstline} tags: {tags}\n'
  o  6 update tags tags: tip
  |
  o  5 changea tags: trunk.goodtag
  |
  o  4 changea3 tags:
  |
  o  3 changea2 tags: trunk.v1
  |
  o  2 changea tags:
  |
  o  1 adda tags:
  |
  o  0 init projA tags:
  

  $ hg tags -q
  tip
  trunk.goodtag
  trunk.v1

  $ cd ..

Convert without tags

  $ hg convert --datesort --config convert.svn.tags= svn-repo A-notags-hg
  initializing destination A-notags-hg repository
  scanning source...
  sorting...
  converting...
  5 init projA
  4 adda
  3 changea
  2 changea2
  1 changea3
  0 changea

  $ hg -R A-notags-hg tags -q
  tip