view contrib/dumprevlog @ 33658:db83a1df03fe stable

subrepo: add tests for git rogue ssh urls (SEC)

'ssh://' has an exploit that will pass the url blindly to the ssh
command, allowing a malicious person to have a subrepo with
'-oProxyCommand' which could run arbitrary code on a user's machine. In
addition, at least on Windows, a pipe '|' is able to execute arbitrary
commands.

When this happens, let's throw a big abort into the user's face so that
they can inspect what's going on.

#!/usr/bin/env python
# Dump revlogs as raw data stream
# $ find .hg/store/ -name "*.i" | xargs dumprevlog > repo.dump

from __future__ import absolute_import, print_function

import sys
from mercurial import (
    node,
    revlog,
    util,
)

for fp in (sys.stdin, sys.stdout, sys.stderr):
    util.setbinary(fp)

for f in sys.argv[1:]:
    binopen = lambda fn: open(fn, 'rb')
    r = revlog.revlog(binopen, f)
    print("file:", f)
    for i in r:
        n = r.node(i)
        p = r.parents(n)
        d = r.revision(n)
        print("node:", node.hex(n))
        print("linkrev:", r.linkrev(i))
        print("parents:", node.hex(p[0]), node.hex(p[1]))
        print("length:", len(d))
        print("-start-")
        print(d)
        print("-end-")