diff -r e10745311406 -r f93975a5ebe8 mercurial/sshpeer.py
--- a/mercurial/sshpeer.py	Fri Aug 04 14:00:03 2017 -0400
+++ b/mercurial/sshpeer.py	Tue Aug 01 14:40:19 2017 -0700
@@ -138,6 +138,8 @@
         if u.scheme != 'ssh' or not u.host or u.path is None:
             self._abort(error.RepoError(_("couldn't parse location %s") % path))
 
+        util.checksafessh(path)
+
         self.user = u.user
         if u.passwd is not None:
             self._abort(error.RepoError(_("password in URL not supported")))