[PATCH] hgweb: make raw file download configurable and disabled (BC) (issue2923)

[Matt Mackall]

On Sun, 2011-07-31 at 02:02 +0200, Mads Kiilerich wrote:
> # HG changeset patch
> # User Mads Kiilerich <mads at kiilerich.com>
> # Date 1312069612 -7200
> # Branch stable
> # Node ID cfa2db1db62e2602c97dff06829000dab1a0d8d8
> # Parent  192e02680d094dc22cf856e70f07348bd6de18d1
> hgweb: make raw file download configurable and disabled (BC) (issue2923)
> 

Here's my rewrite of this based on my earlier comments:

# HG changeset patch
# User Matt Mackall <mpm at selenic.com>
# Date 1312069612 -7200
# Branch stable
# Node ID d06b9c55ddabed66f7e1b5f4193534957232de95
# Parent  dd74cd1e5d49cdedfd2a0cf142a9ce1178e4b748
hgweb: raw file mimetype guessing configurable, off by default (BC) (issue2923)

Before: hgweb made it possible to download file content with a content type
detected from the file extension. It would serve .html files as text/html and
could thus cause XSS vulnerabilities if the web site had any kind of session
authorization and the repository content wasn't fully trusted.

Now: all files default to "application/binary", which all important
browsers will refuse to treat as text/html. See the table here:

https://code.google.com/p/browsersec/wiki/Part2#Survey_of_content_sniffing_behaviors

diff -r dd74cd1e5d49 -r d06b9c55ddab mercurial/help/config.txt
--- a/mercurial/help/config.txt	Mon Aug 01 09:48:10 2011 +0200
+++ b/mercurial/help/config.txt	Sun Jul 31 01:46:52 2011 +0200
@@ -1154,6 +1154,13 @@
     be present in this list. The contents of the allow_push list are
     examined after the deny_push list.
 
+``guessmime``
+    Control MIME types for raw download of file content.
+    Set to True to let hgweb guess the content type from the file
+    extension. This will serve HTML files as ``text/html`` and might
+    allow cross-site scripting attacks when serving untrusted
+    repositories. Default is False.
+   
 ``allow_read``
     If the user has not already been denied repository access due to
     the contents of deny_read, this list determines whether to grant
diff -r dd74cd1e5d49 -r d06b9c55ddab mercurial/hgweb/webcommands.py
--- a/mercurial/hgweb/webcommands.py	Mon Aug 01 09:48:10 2011 +0200
+++ b/mercurial/hgweb/webcommands.py	Sun Jul 31 01:46:52 2011 +0200
@@ -32,6 +32,8 @@
         return changelog(web, req, tmpl)
 
 def rawfile(web, req, tmpl):
+    guessmime = web.configbool('web', 'guessmime', False)
+
     path = webutil.cleanpath(web.repo, req.form.get('file', [''])[0])
     if not path:
         content = manifest(web, req, tmpl)
@@ -50,9 +52,11 @@
 
     path = fctx.path()
     text = fctx.data()
-    mt = mimetypes.guess_type(path)[0]
-    if mt is None:
-        mt = binary(text) and 'application/octet-stream' or 'text/plain'
+    mt = 'application/binary'
+    if guessmime:
+        mt = mimetypes.guess_type(path)[0]
+        if mt is None:
+            mt = binary(text) and 'application/binary' or 'text/plain'
     if mt.startswith('text/'):
         mt += '; charset="%s"' % encoding.encoding
 
diff -r dd74cd1e5d49 -r d06b9c55ddab tests/test-hgweb-raw.t
--- a/tests/test-hgweb-raw.t	Mon Aug 01 09:48:10 2011 +0200
+++ b/tests/test-hgweb-raw.t	Sun Jul 31 01:46:52 2011 +0200
@@ -22,6 +22,28 @@
   $ sleep 1 # wait for server to scream and die
   $ cat getoutput.txt
   200 Script output follows
+  content-type: application/binary
+  content-length: 157
+  content-disposition: inline; filename="some \"text\".txt"
+  
+  This is just some random text
+  that will go inside the file and take a few lines.
+  It is very boring to read, but computers don't
+  care about things like that.
+  $ cat access.log error.log
+  127.0.0.1 - - [*] "GET /?f=a23bf1310f6e;file=sub/some%20%22text%22.txt;style=raw HTTP/1.1" 200 - (glob)
+
+  $ rm access.log error.log
+  $ hg serve -p $HGPORT -A access.log -E error.log -d --pid-file=hg.pid \
+  > --config web.guessmime=True
+
+  $ cat hg.pid >> $DAEMON_PIDS
+  $ ("$TESTDIR/get-with-headers.py" localhost:$HGPORT '/?f=a23bf1310f6e;file=sub/some%20%22text%22.txt;style=raw' content-type content-length content-disposition) >getoutput.txt &
+  $ sleep 5
+  $ kill `cat hg.pid`
+  $ sleep 1 # wait for server to scream and die
+  $ cat getoutput.txt
+  200 Script output follows
   content-type: text/plain; charset="ascii"
   content-length: 157
   content-disposition: inline; filename="some \"text\".txt"



-- 
Mathematics is the supreme nostalgia of our time.