view tests/test-git-clone.t @ 1042:b4d2180739bb

ssh: avoid SSH command-line injection [SEC]
author Sean Farley <sean@farley.io>
date Fri, 04 Aug 2017 14:34:57 -0700
parents 93689e8f27ac
children 9b09dd0a6308
line wrap: on
line source

Load commonly used test logic
  $ . "$TESTDIR/testutil"

  $ git init gitrepo
  Initialized empty Git repository in $TESTTMP/gitrepo/.git/
  $ cd gitrepo
  $ echo alpha > alpha
  $ git add alpha
  $ fn_git_commit -m 'add alpha'
  $ echo beta > beta
  $ git add beta
  $ fn_git_commit -m 'add beta'

  $ cd ..

  $ hg clone gitrepo hgrepo | grep -v '^updating'
  importing git objects into hg
  2 files updated, 0 files merged, 0 files removed, 0 files unresolved
  $ hg -R hgrepo log --graph
  @  changeset:   1:7fe02317c63d
  |  bookmark:    master
  |  tag:         default/master
  |  tag:         tip
  |  user:        test <test@example.org>
  |  date:        Mon Jan 01 00:00:11 2007 +0000
  |  summary:     add beta
  |
  o  changeset:   0:ff7a2f2d8d70
     user:        test <test@example.org>
     date:        Mon Jan 01 00:00:10 2007 +0000
     summary:     add alpha
  

we should have some bookmarks
  $ hg -R hgrepo book
   * master                    1:7fe02317c63d
  $ hg -R hgrepo gverify
  verifying rev 7fe02317c63d against git commit 9497a4ee62e16ee641860d7677cdb2589ea15554

test for ssh vulnerability

  $ hg clone 'git+ssh://-oProxyCommand=rm${IFS}nonexistent/path' | grep -v 'destination\|pulling from'
  abort: potentially unsafe hostname: '-oProxyCommand=rm${IFS}nonexistent'
  [1]
  $ hg clone 'git+ssh://%2DoProxyCommand=rm${IFS}nonexistent/path' | grep -v 'destination\|pulling from'
  abort: potentially unsafe hostname: '-oProxyCommand=rm${IFS}nonexistent'
  [1]

  $ hg init a
  $ cd a
  $ hg pull 'git+ssh://-oProxyCommand=rm${IFS}nonexistent/path' | grep -v 'destination\|pulling from'
  abort: potentially unsafe hostname: '-oProxyCommand=rm${IFS}nonexistent'
  [1]