[PATCH] dispatch: also allow "hg serve --stdio" on the current repo
Martin von Zweigbergk
martinvonz at google.com
Wed May 17 04:30:53 UTC 2017
# HG changeset patch
# User Martin von Zweigbergk <martinvonz at google.com>
# Date 1494994835 25200
# Tue May 16 21:20:35 2017 -0700
# Node ID 70c51c9d67c69d4fb4cfcd5990a8e8906b55f576
# Parent 779a1ae6d0d9eeb487636f665747e92195eb234e
dispatch: also allow "hg serve --stdio" on the current repo
Since 77eaf9539499 (dispatch: protect against malicious 'hg serve
--stdio' invocations (sec), 2017-04-12), we only allow "hg -R <repo>
serve --stdio" (with <repo> not starting with "--"). It seems safe to
also allow it on the current repo (i.e. without "-R <repo>"), so let's
allow that.
diff --git a/mercurial/dispatch.py b/mercurial/dispatch.py
--- a/mercurial/dispatch.py
+++ b/mercurial/dispatch.py
@@ -227,11 +227,18 @@
# shenanigans wherein a user does something like pass
# --debugger or --config=ui.debugger=1 as a repo
# name. This used to actually run the debugger.
- if (len(req.args) != 4 or
- req.args[0] != '-R' or
- req.args[1].startswith('--') or
- req.args[2] != 'serve' or
- req.args[3] != '--stdio'):
+ safe = False
+ if (len(req.args) == 2 and
+ req.args[0] == 'serve' and
+ req.args[1] == '--stdio'):
+ safe = True
+ if (len(req.args) == 4 and
+ req.args[0] == '-R' and
+ not req.args[1].startswith('--') and
+ req.args[2] == 'serve' and
+ req.args[3] == '--stdio'):
+ safe = True
+ if not safe:
raise error.Abort(
_('potentially unsafe serve --stdio invocation: %r') %
(req.args,))
diff --git a/tests/test-ssh.t b/tests/test-ssh.t
--- a/tests/test-ssh.t
+++ b/tests/test-ssh.t
@@ -369,6 +369,10 @@
$ hg -R narf serv --stdio
abort: potentially unsafe serve --stdio invocation: ['-R', 'narf', 'serv', '--stdio']
[255]
+The "-R repo" is not required
+ $ echo heads | hg serve --stdio
+ 41
+ 0000000000000000000000000000000000000000
Test hg-ssh using a helper script that will restore PYTHONPATH (which might
have been cleared by a hg.exe wrapper) and invoke hg-ssh with the right
More information about the Mercurial-devel
mailing list