view tests/test-manifest-merging.t @ 29051:a56296f55a5e stable 3.8.1

convert: pass absolute paths to git (SEC)

Fixes CVE-2016-3105 (1/1).

Previously, it was possible for the repository path passed to git-ls-remote
to be misinterpreted as a URL.

Always passing an absolute path to git is a simple way to avoid this.

  $ hg init base

  $ cd base
  $ echo 'alpha' > alpha
  $ hg ci -A -m 'add alpha'
  adding alpha
  $ cd ..

  $ hg clone base work
  updating to branch default
  1 files updated, 0 files merged, 0 files removed, 0 files unresolved

  $ cd work
  $ echo 'beta' > beta
  $ hg ci -A -m 'add beta'
  adding beta
  $ cd ..

  $ cd base
  $ echo 'gamma' > gamma
  $ hg ci -A -m 'add gamma'
  adding gamma
  $ cd ..

  $ cd work
  $ hg pull -q
  $ hg merge
  1 files updated, 0 files merged, 0 files removed, 0 files unresolved
  (branch merge, don't forget to commit)

Update --clean to revision 1 to simulate a failed merge:

  $ rm alpha beta gamma
  $ hg update --clean 1
  2 files updated, 0 files merged, 0 files removed, 0 files unresolved

  $ cd ..