Merge stable with security patch.
--- a/.hgsigs Sat Apr 08 11:36:39 2017 -0700
+++ b/.hgsigs Tue Apr 18 11:22:42 2017 -0400
@@ -141,3 +141,4 @@
e1526da1e6d84e03146151c9b6e6950fe9a83d7d 0 iQIVAwUAWJIKpUemf/qjRqrOAQjjThAAvl1K/GZBrkanwEPXomewHkWKTEy1s5d5oWmPPGrSb9G4LM/3/abSbQ7fnzkS6IWi4Ao0za68w/MohaVGKoMAslRbelaTqlus0wE3zxb2yQ/j2NeZzFnFEuR/vbUug7uzH+onko2jXrt7VcPNXLOa1/g5CWwaf/YPfJO4zv+atlzBHvuFcQCkdbcOJkccCnBUoR7y0PJoBJX6K7wJQ+hWLdcY4nVaxkGPRmsZJo9qogXZMw1CwJVjofxRI0S/5vMtEqh8srYsg7qlTNv8eYnwdpfuunn2mI7Khx10Tz85PZDnr3SGRiFvdfmT30pI7jL3bhOHALkaoy2VevteJjIyMxANTvjIUBNQUi+7Kj3VIKmkL9NAMAQBbshiQL1wTrXdqOeC8Nm1BfCQEox2yiC6pDFbXVbguwJZ5VKFizTTK6f6BdNYKTVx8lNEdjAsWH8ojgGWwGXBbTkClULHezJ/sODaZzK/+M/IzbGmlF27jJYpdJX8fUoybZNw9lXwIfQQWHmQHEOJYCljD9G1tvYY70+xAFexgBX5Ib48UK4DRITVNecyQZL7bLTzGcM0TAE0EtD4M42wawsYP3Cva9UxShFLICQdPoa4Wmfs6uLbXG1DDLol/j7b6bL+6W8E3AlW+aAPc8GZm51/w3VlYqqciWTc12OJpu8FiD0pZ/iBw+E=
25703b624d27e3917d978af56d6ad59331e0464a 0 iQIcBAABCAAGBQJYuMSwAAoJELnJ3IJKpb3VL3YP/iKWY3+K3cLUBD3Ne5MhfS7N3t6rlk9YD4kmU8JnVeV1oAfg36VCylpbJLBnmQdvC8AfBJOkXi6DHp9RKXXmlsOeoppdWYGX5RMOzuwuGPBii6cA6KFd+WBpBJlRtklz61qGCAtv4q8V1mga0yucihghzt4lD/PPz7mk6yUBL8s3rK+bIHGdEhnK2dfnn/U2G0K/vGgsYZESORISuBclCrrc7M3/v1D+FBMCEYX9FXYU4PhYkKXK1mSqzCB7oENu/WP4ijl1nRnEIyzBV9pKO4ylnXTpbZAr/e4PofzjzPXb0zume1191C3wvgJ4eDautGide/Pxls5s6fJRaIowf5XVYQ5srX/NC9N3K77Hy01t5u8nwcyAhjmajZYuB9j37nmiwFawqS/y2eHovrUjkGdelV8OM7/iAexPRC8i2NcGk0m6XuzWy1Dxr8453VD8Hh3tTeafd6v5uHXSLjwogpu/th5rk/i9/5GBzc1MyJgRTwBhVHi/yFxfyakrSU7HT2cwX/Lb5KgWccogqfvrFYQABIBanxLIeZxTv8OIjC75EYknbxYtvvgb35ZdJytwrTHSZN0S7Ua2dHx2KUnHB6thbLu/v9fYrCgFF76DK4Ogd22Cbvv6NqRoglG26d0bqdwz/l1n3o416YjupteW8LMxHzuwiJy69WP1yi10eNDq
ed5b25874d998ababb181a939dd37a16ea644435 0 iQIcBAABCAAGBQJY4r/gAAoJELnJ3IJKpb3VtwYP/RuTmo252ExXQk/n5zGJZvZQnI86vO1+yGuyOlGFFBwf1v3sOLW1HD7fxF6/GdT8CSQrRqtC17Ya3qtayfY/0AEiSuH2bklBXSB1H5wPyguS5iLqyilCJY0SkHYBIDhJ0xftuIjsa805wdMm3OdclnTOkYT+K1WL8Ylbx/Ni2Lsx1rPpYdcQ/HlTkr5ca1ZbNOOSxSNI4+ilGlKbdSYeEsmqB2sDEiSaDEoxGGoSgzAE9+5Q2FfCGXV0bq4vfmEPoT9lhB4kANE+gcFUvsJTu8Z7EdF8y3CJLiy8+KHO/VLKTGJ1pMperbig9nAXl1AOt+izBFGJGTolbR/ShkkDWB/QVcqIF5CysAWMgnHAx7HjnMDBOANcKzhMMfOi3GUvOCNNIqIIoJHKRHaRk0YbMdt7z2mKpTrRQ9Zadz764jXOqqrPgQFM3jkBHzAvZz9yShrHGh42Y+iReAF9pAN0xPjyZ5Y2qp+DSl0bIQqrAet6Zd3QuoJtXczAeRrAvgn7O9MyLnMyE5s7xxI7o8M7zfWtChLF8ytJUzmRo3iVJNOJH+Zls9N30PGw6vubQAnB5ieaVTv8lnNpcAnEQD/i0tmRSxzyyqoOQbnItIPKFOsaYW+eX9sgJmObU3yDc5k3cs+yAFD2CM/uiUsLcTKyxPNcP1JHBYpwhOjIGczSHVS1
+77eaf9539499a1b8be259ffe7ada787d07857f80 0 iQIcBAABCAAGBQJY9iz9AAoJELnJ3IJKpb3VYqEQAJNkB09sXgYRLA4kGQv3p4v02q9WZ1lHkAhOlNwIh7Zp+pGvT33nHZffByA0v+xtJNV9TNMIFFjkCg3jl5Z42CCe33ZlezGBAzXU+70QPvOR0ojlYk+FdMfeSyCBzWYokIpImwNmwNGKVrUAfywdikCsUC2aRjKg4Mn7GnqWl9WrBG6JEOOUamdx8qV2f6g/utRiqj4YQ86P0y4K3yakwc1LMM+vRfrwvsf1+DZ9t7QRENNKQ6gRnUdfryqSFIWn1VkBVMwIN5W3yIrTMfgH1wAZxbnYHrN5qDK7mcbP7bOA3XWJuEC+3QRnheRFd/21O1dMFuYjaKApXPHRlTGRMOaz2eydbfBopUS1BtfYEh4/B/1yJb9/HDw6LiAjea7ACHiaNec83z643005AvtUuWhjX3QTPkYlQzWaosanGy1IOGtXCPp1L0A+9gUpqyqycfPjQCbST5KRzYSZn3Ngmed5Bb6jsgvg5e5y0En/SQgK/pTKnxemAmFFVvIIrrWGRKj0AD0IFEHEepmwprPRs97EZPoBPFAGmVRuASBeIhFQxSDIXV0ebHJoUmz5w1rTy7U3Eq0ff6nW14kjWOUplatXz5LpWJ3VkZKrI+4gelto5xpTI6gJl2nmezhXQIlInk17cPuxmiHjeMdlOHZRh/zICLhQNL5fGne0ZL+qlrXY
--- a/.hgtags Sat Apr 08 11:36:39 2017 -0700
+++ b/.hgtags Tue Apr 18 11:22:42 2017 -0400
@@ -154,3 +154,4 @@
e1526da1e6d84e03146151c9b6e6950fe9a83d7d 4.1
25703b624d27e3917d978af56d6ad59331e0464a 4.1.1
ed5b25874d998ababb181a939dd37a16ea644435 4.1.2
+77eaf9539499a1b8be259ffe7ada787d07857f80 4.1.3
--- a/contrib/hg-ssh Sat Apr 08 11:36:39 2017 -0700
+++ b/contrib/hg-ssh Tue Apr 18 11:22:42 2017 -0400
@@ -32,7 +32,7 @@
# enable importing on demand to reduce startup time
from mercurial import demandimport; demandimport.enable()
-from mercurial import dispatch
+from mercurial import dispatch, ui as uimod
import sys, os, shlex
@@ -61,14 +61,15 @@
repo = os.path.normpath(os.path.join(cwd, os.path.expanduser(path)))
if repo in allowed_paths:
cmd = ['-R', repo, 'serve', '--stdio']
+ req = dispatch.request(cmd)
if readonly:
- cmd += [
- '--config',
- 'hooks.pretxnopen.hg-ssh=python:__main__.rejectpush',
- '--config',
- 'hooks.prepushkey.hg-ssh=python:__main__.rejectpush'
- ]
- dispatch.dispatch(dispatch.request(cmd))
+ if not req.ui:
+ req.ui = uimod.ui.load()
+ req.ui.setconfig('hooks', 'pretxnopen.hg-ssh',
+ 'python:__main__.rejectpush', 'hg-ssh')
+ req.ui.setconfig('hooks', 'prepushkey.hg-ssh',
+ 'python:__main__.rejectpush', 'hg-ssh')
+ dispatch.dispatch(req)
else:
sys.stderr.write('Illegal repository "%s"\n' % repo)
sys.exit(255)
--- a/mercurial/dispatch.py Sat Apr 08 11:36:39 2017 -0700
+++ b/mercurial/dispatch.py Tue Apr 18 11:22:42 2017 -0400
@@ -155,6 +155,37 @@
pass # happens if called in a thread
def _runcatchfunc():
+ realcmd = None
+ try:
+ cmdargs = fancyopts.fancyopts(req.args[:], commands.globalopts, {})
+ cmd = cmdargs[0]
+ aliases, entry = cmdutil.findcmd(cmd, commands.table, False)
+ realcmd = aliases[0]
+ except (error.UnknownCommand, error.AmbiguousCommand,
+ IndexError, getopt.GetoptError):
+ # Don't handle this here. We know the command is
+ # invalid, but all we're worried about for now is that
+ # it's not a command that server operators expect to
+ # be safe to offer to users in a sandbox.
+ pass
+ if realcmd == 'serve' and '--stdio' in cmdargs:
+ # We want to constrain 'hg serve --stdio' instances pretty
+ # closely, as many shared-ssh access tools want to grant
+ # access to run *only* 'hg -R $repo serve --stdio'. We
+ # restrict to exactly that set of arguments, and prohibit
+ # any repo name that starts with '--' to prevent
+ # shenanigans wherein a user does something like pass
+ # --debugger or --config=ui.debugger=1 as a repo
+ # name. This used to actually run the debugger.
+ if (len(req.args) != 4 or
+ req.args[0] != '-R' or
+ req.args[1].startswith('--') or
+ req.args[2] != 'serve' or
+ req.args[3] != '--stdio'):
+ raise error.Abort(
+ _('potentially unsafe serve --stdio invocation: %r') %
+ (req.args,))
+
try:
debugger = 'pdb'
debugtrace = {
--- a/tests/test-ssh.t Sat Apr 08 11:36:39 2017 -0700
+++ b/tests/test-ssh.t Tue Apr 18 11:22:42 2017 -0400
@@ -357,6 +357,19 @@
abort: destination 'a repo' is not empty
[255]
+Make sure hg is really paranoid in serve --stdio mode. It used to be
+possible to get a debugger REPL by specifying a repo named --debugger.
+ $ hg -R --debugger serve --stdio
+ abort: potentially unsafe serve --stdio invocation: ['-R', '--debugger', 'serve', '--stdio']
+ [255]
+ $ hg -R --config=ui.debugger=yes serve --stdio
+ abort: potentially unsafe serve --stdio invocation: ['-R', '--config=ui.debugger=yes', 'serve', '--stdio']
+ [255]
+Abbreviations of 'serve' also don't work, to avoid shenanigans.
+ $ hg -R narf serv --stdio
+ abort: potentially unsafe serve --stdio invocation: ['-R', 'narf', 'serv', '--stdio']
+ [255]
+
Test hg-ssh using a helper script that will restore PYTHONPATH (which might
have been cleared by a hg.exe wrapper) and invoke hg-ssh with the right
parameters: