Mercurial > hg
view tests/test-diff-copy-depth.t @ 28663:ae279d4a19e9 stable 3.7.3
convert: test for shell injection in git calls (SEC)
CVE-2016-3069 (5/5)
Before recent refactoring we were not escaping calls to git at all
which made such injections possible. Let's have a test for that to
avoid this problem in the future. Reported by Blake Burkhart.
author | Mateusz Kwapich <mitrandir@fb.com> |
---|---|
date | Tue, 22 Mar 2016 17:27:27 -0700 |
parents | bca69641de61 |
children |
line wrap: on
line source
$ for i in aaa zzz; do > hg init t > cd t > > echo > echo "-- With $i" > > touch file > hg add file > hg ci -m "Add" > > hg cp file $i > hg ci -m "a -> $i" > > hg cp $i other-file > echo "different" >> $i > hg ci -m "$i -> other-file" > > hg cp other-file somename > > echo "Status": > hg st -C > echo > echo "Diff:" > hg diff -g > > cd .. > rm -rf t > done -- With aaa Status: A somename other-file Diff: diff --git a/other-file b/somename copy from other-file copy to somename -- With zzz Status: A somename other-file Diff: diff --git a/other-file b/somename copy from other-file copy to somename